For years, many organisations have treated storage as cheap and deletion as optional. Under European regulation that habit is turning into a compliance problem. Regulators, auditors and data subjects are all asking the same question in different ways: why is this information still here?
The starting point is the storage limitation principle in Article 5(1)(e) of the General Data Protection Regulation (GDPR), remarked Copla.
It says personal data may only be kept in identifiable form for as long as the original purpose requires. The regulation does not give a number of years. Each organisation has to set a retention period for every category of data, document why, and show that the data was actually removed on schedule.
The stakes are high. Breaching the Article 5 principles falls into GDPR’s upper fine tier, with penalties of up to €20m or 4% of global annual turnover, whichever is greater. This applies even when no breach or data loss ever occurs.
In June 2026 a Berlin court found that property company Deutsche Wohnen had failed to update its IT systems in time to delete former tenants’ payslips, bank statements and identity documents. It ruled the breach intentional and fined the firm €900,000, well below the roughly €14.5m originally imposed by the data protection authority in 2019. The judgment is not yet final.
GDPR is only one part of the picture. The Digital Operational Resilience Act (DORA) requires financial entities to maintain a register of information on all ICT third-party arrangements and to share it with supervisors on request.
However, neither DORA nor its implementing standards set a retention period for these entries. A proposed five-year rule for terminated arrangements was dropped, so firms must decide for themselves.
NIS2 takes a similar approach. It sets no EU-wide retention period for logs or incident records, leaving national laws to fill the gap. Lithuania requires at least 90 days of log records, while the Czech Republic demands at least 18 months for certain regulated services.
Groups operating across borders therefore need jurisdiction-specific schedules. ISO 27001 adds a further layer. Auditors test firms against their own documented procedures, so a stated period that systems ignore becomes an audit finding.
Retention requirements vary widely in practice. Accounting records must be kept for five years in Denmark and ten in Germany, France and Italy. Anti-money laundering records must be held for five years after a customer relationship ends. The trigger event matters as much as the length of the period. Applying one blanket rule from the date data is created can lead to deleting records too early or keeping others with no lawful purpose.
A defensible policy covers scope, data categories, a detailed schedule, storage controls, deletion methods, legal holds, ownership and an annual review. Ultimately, a written policy proves nothing without evidence that deletion actually took place.
Read the full Copla post here.
Copyright © 2026 FinTech Global
