Keep personal data in identifiable form only as long as you need it — then delete or anonymise.
Storage limitation requires that data be kept in a form allowing identification for no longer than necessary for the purpose.
It is the driver behind data-retention schedules and routine deletion or anonymisation.
In the Regulation
Related terms
Data minimisationCollect only the personal data you actually need for your purpose — no more.AnonymisationIrreversibly stripping data of anything that could identify a person — after which the GDPR no longer applies.Right to erasureThe data subject's right to have their personal data deleted in certain circumstances.
Need this applied to your business?
The articles and FAQs turn GDPR terms into working knowledge.