Companies accumulate, on a daily basis, large volumes of personal data customer records, employee documents, supplier information, marketing databases, contracts, invoices, access logs, service records and many others. This storage, though often necessary for business operations, cannot be unlimited. <\/p>\n\n\n\n
Both the Brazilian General Data Protection Law (LGPD) and the European Union General Data Protection Regulation (GDPR) share a common premise: personal data must be kept only for as long as necessary to fulfil the purpose that justified its collection, unless there is a legal basis permitting its retention for a longer period.<\/p>\n\n\n\n
In practice, this is one of the most sensitive aspects of privacy governance. Although the rule is straightforward, its application requires careful assessment, since data protection legislation generally does not establish a single, universal retention period for each type of personal data. In this context, companies are responsible for defining their own criteria, taking into account the purpose of the processing, legal or regulatory obligations, limitation periods, operational needs and risks to data subjects.<\/p>\n\n\n\n
Why does data retention matter?<\/strong><\/p>\n\n\n\n Excessive retention of personal data increases legal, operational and security risks. The longer a company holds personal data without a clear processing need, the greater its exposure in the event of a security incident, unauthorized access, use of outdated information, data subject requests or scrutiny by regulatory authorities.<\/p>\n\n\n\n In this context, retention and disposal rules should not be seen merely as a formal privacy requirement. On the contrary, they form part of sound information governance and help reduce concrete risks for the company.<\/p>\n\n\n\n A well-structured retention policy enables companies to:<\/p>\n\n\n\n - define retention and disposal periods;<\/p>\n\n\n\n - reduce the unnecessary storage of personal data;<\/p>\n\n\n\n - facilitate responses to data subject requests;<\/p>\n\n\n\n - reduce security risks;<\/p>\n\n\n\n - demonstrate legal and regulatory compliance.<\/p>\n\n\n\n LGPD and GDPR: retention, deletion and legal exceptions<\/strong><\/p>\n\n\n\n The LGPD and the GDPR adopt a similar logic: personal data must be retained only for as long as it is necessary for the purpose that justified the processing. Once that purpose has been fulfilled, the general rule becomes the deletion or anonymisation of the data, unless there is a legal basis authorising its continued retention<\/p>\n\n\n\n In Brazil, the LGPD permits the retention of personal data in specific circumstances, such as compliance with a legal or regulatory obligation, research by a research body, transfer to third parties in accordance with the law, or exclusive use by the controller, provided that the data is anonymised wherever applicable.<\/p>\n\n\n\n Similarly, the GDPR allows retention where necessary, for example, for compliance with a legal obligation, the establishment, exercise or defence of legal claims, or for certain purposes of public interest, research, statistics or archiving, provided to the applicable safeguards.<\/p>\n\n\n\n In this context, the key point is that companies must not retain personal data indefinitely or merely \u201cas a precaution\u201d. Compliance therefore depends on the ability to define, document and consistently apply clear criteria for retention and disposal, aligned with legitimate legal, regulatory and business needs.<\/p>\n\n\n\n Guidance from data protection authorities<\/strong><\/p>\n\n\n\n Data protection authorities generally require companies to define retention periods based on necessity and proportionality criteria. In other words, it is not sufficient to retain data because it \u201cmight be useful in the future\u201d: it is necessary to objectively justify why that data is still needed.<\/p>\n\n\n\n The Information Commissioner\u2019s Office (ICO), the UK data protection authority, advises organizations to be able to justify how long they retain personal data, to establish standard retention periods wherever possible, to periodically review stored information and to delete or anonymize data that is no longer needed.<\/p>\n\n\n\n Complementarily, the French data protection authority (CNIL) also provides practical parameters on the subject. In the context of commercial management, for example, the CNIL indicates that customer data used for prospecting may be retained during the commercial relationship and, after it ends, generally for up to three years. Data relating to potential customers may generally be retained for three years from the date of collection or from the date of the last contact initiated by the potential customer.<\/p>\n\n\n\n This guidance does not replace a case-by-case analysis, but serves as a relevant reference for companies that are structuring their internal retention schedules.<\/p>\n\n\n\n Carrefour and the risks of excessive retention<\/strong><\/p>\n\n\n\n The Carrefour case clearly illustrates the risks associated with excessive retention of personal data.<\/p>\n\n\n\n In 2020, the CNIL imposed a fine of EUR 2.25 million on Carrefour France for several GDPR violations, including excessive data retention. Among other findings, the authority determined that the company had retained inactive customers\u2019 data for longer than necessary and had kept copies of identity documents submitted in connection with data subject requests for longer than was justifiable.<\/p>\n\n\n\n This case demonstrates that authorities do not assess retention periods merely in the abstract. In practice, they expect companies to implement effective deletion routines, document their retention criteria and ensure that their internal systems actually reflect the privacy policies and notices made available to the public.<\/p>\n\n\n\n The role of Controllers and Processors in data retention<\/strong><\/p>\n\n\n\n The obligations relating to retention may vary depending on whether the company acts as a controller or processor of personal data. In this context, Controllers and Processors assume distinct, albeit complementary, responsibilities.<\/p>\n\n\n\n Controllers are generally responsible for defining the purposes of processing and the applicable retention periods. Processors, in turn, must process personal data in accordance with the documented instructions of the controller and, at the end of the service provision, return, delete or otherwise dispose of the data, unless there is a legal obligation justifying its retention.<\/p>\n\n\n\n Indiscriminate retention, in this scenario, may generate risks for both parties. For the Controller, retaining data without criteria makes it difficult to control the information lifecycle and may increase regulatory exposure. For the Processor, on the other hand, retaining data beyond what is necessary may increase security risks, contractual liability and questions regarding adherence to the instructions received.<\/p>\n\n\n\n For this reason, contracts involving personal data processing must clearly set out what will happen to the data at the end of the contractual relationship, including return, deletion, anonymisation, retention due to legal obligation and, where applicable, evidence of disposal.<\/p>\n\n\n\n What companies should do<\/strong><\/p>\n\n\n\n To manage retention and disposal risks, companies should adopt practical and documented measures, including:<\/p>\n\n\n\n\n\n - mapping the main categories of personal data processed;<\/p>\n\n\n\n - identifying the purpose and legal basis for each processing activity;<\/p>\n\n\n\n - defining objective retention periods or criteria;<\/p>\n\n\n\n - linking retention periods to legal obligations, limitation periods and legitimate business needs;<\/p>\n\n\n\n - implementing secure deletion or anonymisation routines;<\/p>\n\n\n\n - reviewing legacy databases and inactive records;<\/p>\n\n\n\n - ensuring that privacy notices and internal policies reflect the practices actually adopted;<\/p>\n\n\n\n - including retention and deletion clauses in contracts involving personal data processing;<\/span>- documenting exceptions where data must be retained for legal, regulatory or litigation-related reasons.<\/p>\n\n\n\n Data retention, though often underestimated, is one of the central elements of data protection compliance. Retaining data for longer than necessary increases legal, security and reputational risks. On the other hand, deleting data too early may compromise compliance with legal obligations or the company\u2019s ability to defend its rights.<\/p>\n\n\n\n Given this, the solution does not lie in adopting a generic retention period for all data, but in structuring a retention and disposal policy supported by a retention schedule, clear internal responsibilities and practical deletion or anonymisation procedures.<\/p>\n\n\n\n At GTLawyers, our data protection team assists companies in drafting and implementing retention and disposal policies, reviewing data processing contracts, mapping legal retention obligations and aligning internal practices with the LGPD, the GDPR and other international privacy standards.<\/p>\n\n\n\n <\/p>","protected":false},"excerpt":{"rendered":" Empresas acumulam, diariamente, grandes volumes de dados pessoais: cadastros de clientes, documentos de colaboradores, informa\u00e7\u00f5es de fornecedores, bases de marketing, contratos, faturas, logs de acesso, registros de atendimento e muitos outros. Esse armazenamento, embora muitas vezes necess\u00e1rio para a opera\u00e7\u00e3o, n\u00e3o pode ser ilimitado. Tanto a Lei Geral de Prote\u00e7\u00e3o de Dados Pessoais brasileira (LGPD) […]<\/p>\n","protected":false},"author":8,"featured_media":2320,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[6],"tags":[],"class_list":["post-2318","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-artigos"],"acf":[],"yoast_head":"\n