For years, many organisations have treated storage as cheap and deletion as optional. Under European regulation that habit is turning into a compliance problem. Regulators, auditors and data subjects are all asking the same question in different ways: why is this information still here?

The starting point is the storage limitation principle in Article 5(1)(e) of the General Data Protection Regulation (GDPR), remarked Copla.

It says personal data may only be kept in identifiable form for as long as the original purpose requires. The regulation does not give a number of years. Each organisation has to set a retention period for every category of data, document why, and show that the data was actually removed on schedule.

The stakes are high. Breaching the Article 5 principles falls into GDPR’s upper fine tier, with penalties of up to €20m or 4% of global annual turnover, whichever is greater. This applies even when no breach or data loss ever occurs.

In June 2026 a Berlin court found that property company Deutsche Wohnen had failed to update its IT systems in time to delete former tenants’ payslips, bank statements and identity documents. It ruled the breach intentional and fined the firm €900,000, well below the roughly €14.5m originally imposed by the data protection authority in 2019. The judgment is not yet final.

GDPR is only one part of the picture. The Digital Operational Resilience Act (DORA) requires financial entities to maintain a register of information on all ICT third-party arrangements and to share it with supervisors on request.

Source link