Findings
11 Retention not set, or above the period you set
The statutes and guidance held here ask for a retention period tied to the purpose. The maximum you set is a threshold you set, not a legal deadline; a period strictly above it is flagged, and the figures the guidance names (a few days for footage in the EDPB guidelines, one month for cameras and two months for location in the CNIL's) are shown beside it as guidance.
For the DPO: How long is this data kept, and why that long?
Where it comes from, location by location
- Retentionstatutory requirementKept no longer than the purpose needs, with a set retention period, and deleted once no longer needed. GDPR Art. 5WP249 para 3.1(d)
- Retentionofficial guidance, not lawFootage usually erased within a few days; beyond 72 hours needs stronger justification. EDPB video guidelines para 8 official guidance, not law
- Retentionstatutory requirementVideo data deleted without delay once no longer needed. BDSG s 4(5)
- Retentionofficial guidance, not lawImages in principle kept no more than one month. CNIL guidance VID-7 official guidance, not law
- Retentionverification requiredRecordings kept up to six months, analysis documents up to a year. CNIL guidance CALL-5 official guidance, not law
- Retentionofficial guidance, not lawLocation data in principle two months (one year for route optimisation or proof, five years for working time). CNIL guidance GEO-6 official guidance, not law
- Retentionofficial guidance, not lawConnection logs no more than six months; no automatic copy of all staff email. CNIL guidance NET-2 official guidance, not law
- Retentionstatutory requirementA retention schedule justified by business need, reviewed, and not kept in case a use turns up. UK GDPR Art. 5ICO monitoring guidance para 1.15
- Retentionofficial guidance, not lawThe shortest period the purpose needs, never the recorder's default. ICO video guidance P.11 official guidance, not law
- Retentionstatutory requirementDestroy or permanently de-identify records no longer needed for a purpose the Act allows. ACT WPA s 44(2)
- Retentionstatutory requirementDestroy or de-identify personal information no longer needed. (when you say the Privacy Act applies) APP 11
- Retentionstatutory requirementDestroyed when the purpose is met or within three years of the last interaction, whichever comes first. BIPA s 15(a)
- Retentionstatutory requirementRetention periods disclosed and no longer than reasonably necessary. (when you say the business meets the CCPA thresholds) CCPA 1798.100
- Retentionofficial guidance, not lawKept only as long as the purpose justifies. ILO code para 8.5 official guidance, not law