Data classification and retention: how long to keep each dataset and why

Two questions, one policy

A good policy answers two questions for each type of data: how sensitive is it? (classification) and how long must it be kept? (retention). It is like an office filing room: you do not keep a payslip the same way as meeting notes.

Step 1: classify

• Public: anyone can see it.
• Internal: the organisation only.
• Confidential: role-limited access; includes most personal data.
• Restricted: highest protection; for example special categories of personal data.

Four levels are enough to start. More levels are usually hard to apply.

Step 2: set periods

For personal data, the GDPR asks you not to keep it longer than necessary (Article 5(1)(e)). Other laws may impose minimum periods, for example tax, employment or sector rules. That is why the period is decided with legal and privacy, not by IT alone. Record the period, the reason and the rule you rely on.

Step 3: decide what happens at expiry

• Delete from all systems, including backups according to their cycle.
• Anonymise if you need to keep statistical information (carefully: effective anonymisation is demanding).
• Record the action taken.

Common mistakes

• “Indefinite” periods with no justification.
• A policy nobody runs: nothing gets deleted.
• Forgetting copies in spreadsheets, emails and test environments.

Link to AI

If you train or use models with personal data, retention also affects training sets and usage logs. Define it from the start.

Frequently asked questions

What does the GDPR say about how long to keep data?

Only as long as necessary for the purposes (Art. 5(1)(e)); it sets no general period.

Who decides the period?

The data owner with legal and privacy support.

Informational content, not legal advice. Specific periods depend on your sector and country.