Most organisations know they must protect personal data. Fewer ask a simpler question: How long should we hold it or do we still need to keep it? In September 2026, the Irish Data Protection Commission fined the Health Service Executive (HSE) for leaving patient records in disused, unsecured hospital buildings. Intruders walked in and filmed them. The case is a reminder that old data is not harmless data. What the law says The storage limitation principle (Article 5(1)(e) UK
