Data Retention

The GDPR sets a principle, not a number of years. Under Article 5(1)(e), personal data must be kept in a form which permits identification of people for no longer than is necessary for the purposes for which it is processed. The regulation calls this storage limitation.

The period therefore follows from the purpose. Keeping files indefinitely because they might be useful one day is not a purpose.

Two more provisions make the period visible. The firm must tell people, when it collects their data, how long the data will be stored or which criteria decide that (Article 13(2)(a), or Article 14(2)(a) where the data comes from someone else). Its record of processing activities must give, where possible, the envisaged time limits for erasure of each category of data (Article 30(1)(f)). The controller must also be able to demonstrate that it follows the principle (Article 5(2)).

Laws that require a record to exist for a set time. For a law firm, an accounting practice or another obliged entity, the main one at EU level is the Anti-Money Laundering Regulation, which applies from 10 July 2027. Until then, national laws implementing the earlier Directive (EU) 2015/849 apply.

Article 77 requires obliged entities to retain a copy of the documents and information obtained in customer due diligence, the record of any assessment of a possible suspicious transaction, and the records needed to identify transactions. The period is five years. It starts on the date the business relationship ends, on the date of an occasional transaction, or on the date the firm refused to act (Article 77(3)).

The same paragraph sets the end. Obliged entities "shall delete personal data upon expiry of the five-year period", unless another EU act or a national law that complies with the GDPR sets a different retention period. A competent authority may require further retention in a single case, for no more than five more years.

National law adds its own minimum periods. Tax and accounting rules, the rules of a profession on client files, and employment law each set periods for particular records. Limitation periods for claims are a further reason to keep a file. All of these differ by country, so the figures have to be taken from the national texts. Where a law requires a record to be kept, that law is the legal basis for keeping it (Article 6(1)(c) of the GDPR).

A client can ask, and the firm can refuse for as long as a legal duty to keep the data applies. Article 17(1) gives a person the right to have personal data erased, for example where it is no longer necessary for the purpose it was collected for. Article 17(3) lists the limits. The right does not apply to the extent that processing is necessary for compliance with a legal obligation under EU or member state law, or for the establishment, exercise or defence of legal claims.

A request to erase a due diligence file two years after the engagement ended therefore fails against the retention rule. The firm must still reply within one month, give its reasons and say that the person can complain to the supervisory authority (Article 12(4)). Once the period has run and no other ground remains, the data has to go, whether or not anyone asks.

A retention schedule is a table of the firm's record types with a period and a reason for each. Each step uses the result of the one before.

1. List the kinds of record the firm holds. The record of processing activities is the usual starting point. Include email, backups and data held by suppliers.
2. Write down the purpose of each kind.
3. Find every legal minimum that applies to it: anti-money laundering, tax, accounting, professional rules.
4. Set the period. Take the longest legal minimum. Go beyond it only where a stated purpose, such as defending a claim within the limitation period, needs more time. A purpose of the firm's own does not extend a period where the law fixes the point of deletion, as the Anti-Money Laundering Regulation does for due diligence records (Article 77(3)).
5. Name the event that starts the clock, such as the end of the client relationship. A period with no start date cannot be applied.
6. Decide what happens at the end: deletion, or anonymisation where the firm needs the figures but not the names.
7. Record the result in the record of processing activities and in the privacy notice. Review it when the law or the firm's services change.

One exception belongs in the schedule itself. Deletion is paused for records needed in a dispute, an investigation or a request from an authority, until that matter ends.

It should be deleted, or changed so that it no longer identifies anyone. Storage limitation applies to data "in a form which permits identification", so figures stripped of every link to a person fall outside it.

Deletion has to reach every copy. That includes mailboxes, shared drives, downloads on staff devices, backups and the systems of suppliers. A processor must delete or return all personal data at the end of its service, at the controller's choice, and delete existing copies unless the law requires storage (Article 28(3)(g)).

The GDPR allows longer storage for archiving in the public interest, for scientific or historical research and for statistics, subject to the safeguards in Article 89(1). A firm's wish to keep old client files for reference does not come under it.

A short log of what was deleted, when and under which rule shows later that the firm followed its schedule.