Storage Limitation

Data kept without a reason is a liability. It can be breached, misused or demanded in a dispute, and it grows more out of date every year. Storage limitation answers this by tying retention to purpose. The organisation decides, for each type of data, how long it is truly needed, writes that period down and acts on it when the time ends. Some laws set fixed periods, such as tax or financial record rules, which then override a wish to delete sooner. Others leave the period to the organisation, which must be able to justify it. Deletion can be replaced by irreversible anonymisation, since the data then no longer identifies anyone. In practice the principle is met through a retention schedule, automated deletion jobs and clean-up of backups and archives. After a breach, investigators ask why years-old records were still in the system, and a missing retention rationale counts against the organisation.

An online travel company finds it still holds passport scans of customers who last booked eight years ago. Its stated purpose ended after the trip, and no law requires the scans. The company deletes them, sets an automatic purge six months after each journey, and records the reason for that period in its retention schedule.