Design a data retention policy compliant with GDPR

Example Answer

I would define retention by data category and purpose, with the privacy or legal owner confirming applicable obligations. GDPR does not prescribe one universal five-to-seven-year period for all data; personal data should generally be kept only as long as necessary for its purpose, subject to applicable exceptions and legal obligations. I would document an owner, the retention trigger, period or review criteria, deletion process, and evidence that deletion completed. For example, analytics events and invoices may need different policies. Encryption or pseudonymization alone does not remove retention responsibilities.

Policy artifact

Create a table with: data category, processing purpose, approved period, start event, responsible owner, storage locations, deletion method, and applicable holds or exceptions. The period must come from the actual purpose and jurisdiction, not an invented default.

Engineering controls should cover replicas, exports, derived datasets, processors, and backups. For backups that expire on a schedule, define restricted access and a restore process that reapplies required deletions before restored data is used. Test deletion jobs and record failures. A policy document alone is not proof of compliance.

Practice follow-up

How would you prevent a backup restore from reintroducing a previously deleted customer record?

Sources

European Commission GDPR principles; European Commission personal-data scope.