Storage limitation matters because every item of personal data has a lifecycle. Information is collected, used, shared and eventually reaches a point where it is no longer needed. The GDPR recognises that retaining personal data indefinitely increases privacy risks, creates unnecessary costs and undermines public trust. The storage limitation principle requires organisations to keep personal data only for as long as it serves a legitimate purpose.
What Does The GDPR Say?
Article 5(e) of the GDPR (brought into UK law by the Data Protection Act 2018) says that “data shall kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed; personal data may be stored for longer periods insofar as the personal data will be processed solely for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes subject to implementation of the appropriate technical and organisational measures required by the GDPR in order to safeguard the rights and freedoms of individuals (‘storage limitation’).”
What Does This Mean?
Retaining personal data indefinitely can:
- increase cyber security risks
- increase the impact of data breaches
- make subject access requests more difficult
- increase storage and governance costs
- reduce data quality
- undermine public confidence
The principle of storage limitation encourages organisations to retain information because it is needed, not simply because it exists. It emphasises that personal data should not be stored for longer than is necessary for the purpose for which it was collected. In short it means:
- you must understand what you need personal data for
- decide when this processing activity is due to end
- you must have arrangements for the deletion of personal data when it is no longer needed
To grasp its significance, let’s break it down:
Defining Storage Limitation
The principle of storage limitation aims to prevent the indefinite retention of personal data. Organisations must establish clear criteria for determining how long data is kept, and this period should align with the intended purpose for which the data was collected.
That means defining retention periods for different categories of personal data and different processing activities. These might include:
- marketing to potential customers
- employment, such as recruitment or payroll
- delivering products and services to existing customers
Identifiable Form
You may not necessarily need to fully delete the data that you hold. You could anonymise it and keep aggregate data. For example, rather than keep individual customer records you could keep high level, anonymous data to support analytics such as sales patterns or periods of high demand for services.
No Longer Than Necessary
Necessity depends upon:
- the purpose the data is being processed for
- legal obligations
- contractual requirements
- regulatory expectations
- operational need
- individual rights
One retention period will not fit every category of personal data. Also, circumstances may require a person’s data to be retained longer than planned on a case by case basis such as when there are complaints, legal action is in progress, or when people are exercising their data rights.
Archiving Purposes and Research
As the text of the GDPR notes personal data may be retained in identifiable form for archiving purposes and for research. However, appropriate steps have to be taken to ensure people’s “rights and freedoms” are protected. That means at a minimum having the right levels of security and access restriction to prevent a data breach.
You must have a clear purpose in mind if you archive personal data. Don’t keep it “just in case”. You also need to be clear about why anonymised or pseudonymised data would not meet your needs. Finally, you cannot reuse data retained for research purposes for anything else.
Aligning Storage Limitation with Data Minimisation
Storage limitation is closely tied to principle of data minimisation. It is much easier to abide by the principle of storage limitation if only the minimum necessary data is collected in the first place. Again, this means understanding what data you need and what you will be processing it for.
Storage Limitation and Privacy by Design
Retention periods should be designed into systems before implementation.
For example:
Before introducing a new process or IT system organisations should decide:
- how long information will be retained
- who reviews retention
- how deletion will occur
- whether anonymisation is possible
By planning for storage limitation, the end of the information lifecycle, you can ensure that data collection and processing matches with security systems, access controls, and ultimate retention.
The Importance of Storage Limitation
Although it is a statutory requirement to comply with the GDPR, there are wider benefits to getting compliance with the storage limitation principle right.
Safeguarding Individual Privacy
By adhering to storage limitation, organisations respect the privacy of individuals. By ensuring data are not kept indefinitely you can reduce risk of a data breach, and avoid the consequences of lost or stolen data.
Enhancing Data Accuracy
Reducing the volume of stored data can lead to better data accuracy. Outdated or irrelevant information can introduce errors into datasets, which may impact decisions and processes reliant on this data.
Improving Efficiency
By reducing the volume of personal data that you have you will make it easier and quicker to find the data you need. It can also save money because there are costs associated with both storing data, and processing data.
The Obligations Imposed by Storage Limitation
The GDPR imposes specific obligations on data controllers and processors regarding the application of the storage limitation principle. The technical and organisational measures that need to be put in place are not difficult to do, but they are important for GDPR compliance.
Determining Retention Periods
Organisations must establish and document the retention periods for different categories of personal data. These retention periods must be reasonable and aligned with the data’s intended purpose.
Your retention periods should be set out in a clear retention policy.
For example, some employment information will need to be retained for decades if it relates to pensions. Alternatively some data, like sickness absence, may only be needed for a short while – perhaps a year.
Retention periods should specify how long personal data are normally retained before review or disposal. Organisations should only depart from those periods where there is a documented and justifiable reason for doing so.Bottom of Form
Periodic Review and Deletion
Regularly reviewing and deleting data that surpasses its retention period is important. This ensures that data is not stored indefinitely and is promptly disposed of when it is no longer necessary.
Then of course the data need to be deleted. Hard copy information should be shredded or disposed of through confidential waste disposal. Electronic data should be thoroughly deleted and it should not be accessible via backups or in a “deleted items” folder.
Demonstrating Compliance
For organisations and individuals navigating data protection regulations, following best practices is vital:
Record of Processing Activity
Maintaining a comprehensive inventory of the personal data you collect and store is the first step in adhering to storage limitation. This inventory should include details such as the data’s source, purpose, and retention period.
This inventory is known as a Record of Processing Activity (ROPA) and is one of the requirements of data protection law.
Secure Data Disposal
Develop secure systems for data erasure that has reached the end of its retention period. This includes digital data, physical records, and ensuring that no residual copies exist.
Data Subject Rights
Be prepared to respond to data subject requests regarding the deletion or modification of their personal data. Implementing efficient processes to address such requests is crucial.
There are two key rights to be aware of when it comes to the principle of storage limitation:
- Right of Access: when people make subject access requests you must tell them what personal data you have, what you use it for, and who you have shared it with (among other things). It is therefore important to know what data you have and what data has been deleted.
- Right of Erasure: this is also known as “the right to be forgotten”. It means in some circumstances people can ask for the deletion of their personal data. This is not an absolute right and will only apply where you do not need to keep the data for your own business.
Conclusion: Key Takeaways on Storage Limitation
Storage limitation, is an integral component of the GDPR’s framework. Understanding and applying this principle is not just a legal requirement; it is an ethical obligation that helps safeguard individual privacy, enhance data accuracy, and mitigate data-related risks. By adopting best practices for data storage and following legal requirements, organisations and individuals can ensure that personal data is retained only for as long as necessary, promoting responsible and