Data Retention and the GDPR: Why "Just in Case" Is Not a Lawful Reason
Most organisations know they must protect personal data. Fewer ask a simpler question: How long should we hold it or do we still need to keep it?
In September 2026, the Irish Data Protection Commission fined the Health Service Executive (HSE) for leaving patient records in disused, unsecured hospital buildings. Intruders walked in and filmed them. The case is a reminder that old data is not harmless data.
What the law says
The storage limitation principle (Article 5(1)(e) UK GDPR says personal data must be kept in an identifiable form for no longer than is necessary for the purposes it was processed. The ICO's guidance boils this down to four points:
You must be able to justify how long you keep personal data.
A retention policy setting standard periods is expected wherever possible.
You should review the data you hold periodically.
You should erase or anonymise data you no longer need.
The law sets no universal time limit. The Information Commissioner’s Office (ICO) says the right period depends on your situation. Its political campaigning guidance is blunt that data should not be kept on a "just in case" basis.
Deleting everything immediately is not the aim either. Data can be kept for as long as the purpose and a lawful basis remain valid. Once they fall away, it must go.
When over-retention becomes expensive
Health Service Executive (Ireland, 2026). The Data Protection Commission fined the HSE a total of €645,000, including €300,000 for breaching the storage limitation principle. The inquiry followed unauthorised access to paper records held in two former psychiatric hospitals, St Loman's in Mullingar and St Conal's in Letterkenny. Videos posted on social media showed medical records stored in the buildings. A separate €300,000 covered security failings, and smaller fines covered breach notification. The DPC also issued a reprimand and corrective orders, and treated the HSE's earlier, similar infringements involving paper healthcare records as an aggravating factor. Over-retention and weak security compound each other, and health data raises the stakes.
Deutsche Wohnen (Germany, 2019). The Berlin data protection authority fined the property company €14.5 million. It had stored tenant data, including payslips, references and bank statements, in an archive system that could not delete anything. The regulator found no legal ground for keeping the data and breaches of data protection by design. A follow-up audit showed the clean-up had not been done. Lexology has a summary.
Taxa 4x35 (Denmark). Datatilsynet found the taxi company held data on around 9 million rides beyond its own two-year retention policy. It had written a policy and then not followed it. The authority recommended a DKK 1.2 million fine, roughly €160,000. The company argued the data was anonymised because names were deleted, but phone numbers still acted as a key to the records.
There are no ICO fines imposed solely for over-retention, but the ICO treats it as an enforceable failing. In its enforcement notice against Clearview AI, it criticised the lack of a retention policy, saying the company could not ensure data was not held longer than necessary. Breaches of the UK GDPR principles can attract fines of up to £17.5 million or 4% of worldwide turnover, whichever is higher.
Regulators are watching
In February 2026 the European Data Protection Board published the findings of a coordinated enforcement action covering 764 controllers on how organisations handle the right to erasure. One recurring problem was difficulty defining and applying retention periods, especially for smaller controllers. Regulators also reported problems deleting data from back-ups and inconsistent practices.
Six practical steps
Map your data. You cannot set a retention period for data you have not found, including paper records in off-site storage.
Set a retention schedule. Give each category a period and a stated reason, such as a legal requirement, contract or clinical need.
Follow it. Taxa had a policy and was still penalised.
Automate deletion where you can. Deutsche Wohnen's real failing was a system that could not erase.
Handle back-ups and archives. Decide how and when archived copies, digital or paper, are destroyed.
Anonymise properly. Removing a name is not enough if other identifiers still point to the person.
Review your schedule regularly and record your reasons. If a regulator asks, a documented rationale carries weight.
To find out more about how we can help your organisation review and manage its data retention obligations, contact us at info@sarsearonconsulting.com
Comments