# Principle (e): Storage limitation

- Due to changes made by the Data (Use and Access) Act, this guidance is under review and may be subject to change. The [Plans for new and updated guidance page](/about-the-ico/what-we-do/our-plans-for-new-and-updated-guidance/) will tell you about which guidance will be updated and when this will happen.

## At a glance

- You must not keep personal data for longer than you need it.

- You need to think about – and be able to justify – how long you keep personal data. This will depend on your purposes for holding the data.

- You need a policy setting standard retention periods wherever possible, to comply with documentation requirements.

- You should also periodically review the data you hold, and erase or anonymise it when you no longer need it.

- You must carefully consider any challenges to your retention of data. Individuals have a right to erasure if you no longer need the data.

- You can keep personal data for longer if you are only keeping it for public interest archiving, scientific or historical research, or statistical purposes.

## Checklist

☐ We know what personal data we hold and why we need it.

☐ We carefully consider and can justify how long we keep personal data.

☐ We have a policy with standard retention periods where possible, in line with documentation obligations.

☐ We regularly review our information and erase or anonymise personal data when we no longer need it.

☐ We have appropriate processes in place to comply with individuals’ requests for erasure under ‘the right to be forgotten’.

☐ We clearly identify any personal data that we need to keep for public interest archiving, scientific or historical research, or statistical purposes.

**Other resources**

For more detailed checklists and practice advice on retention, please use the ICO’s [self-assessment toolkit - records management checklist](/for-organisations/advice-for-small-organisations/getting-started-with-gdpr/data-protection-self-assessment-medium-businesses/records-management-checklist/)

## In brief

###

Article 5(1)(e) says:

*“*1. Personal data shall be:

(e) kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed; personal data may be stored for longer periods insofar as the personal data will be processed solely for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) subject to implementation of the appropriate technical and organisational measures required by this Regulation in order to safeguard the rights and freedoms of the data subject (‘storage limitation’)”

So, even if you collect and use personal data fairly and lawfully, you cannot keep it for longer than you actually need it.

There are close links here with the data minimisation and accuracy principles.

The UK GDPR does not set specific time limits for different types of data. This is up to you, and will depend on how long you need the data for your specified purposes.

###

Ensuring that you erase or anonymise personal data when you no longer need it will reduce the risk that it becomes irrelevant, excessive, inaccurate or out of date. Apart from helping you to comply with the data minimisation and accuracy principles, this also reduces the risk that you will use such data in error – to the detriment of all concerned.

Personal data held for too long will, by definition, be unnecessary. You are unlikely to have a lawful basis for retention.

From a more practical perspective, it is inefficient to hold more personal data than you need, and there may be unnecessary costs associated with storage and security.

Remember that you must also respond to subject access requests for any personal data you hold. This may be more difficult if you are holding old data for longer than you need.

Good practice around storage limitation - with clear policies on retention periods and erasure - is also likely to reduce the burden of dealing with queries about retention and individual requests for erasure.

###