Keep personal data in identifiable form only as long as you need it — then delete or anonymise.
Storage limitation requires that data be kept in a form allowing identification for no longer than necessary for the purpose.
It is the driver behind data-retention schedules and routine deletion or anonymisation.
In the Regulation
Related terms
Data minimisationCollect only the personal data you actually need for your purpose — no more.AnonymisationIrreversibly stripping data of anything that could identify a person — after which the GDPR no longer applies.Right to erasureThe data subject's right to have their personal data deleted in certain circumstances.
Need this applied to your business?
Our data-protection lawyers turn GDPR terms into a working plan.