Fiche 18/54 Part 2 — Core Principles Intermediate Reviewed 2026-08-23

Storage Limitation (Art. 5.1.e)

The GDPR does not mandate an arbitrary universal duration. Storage periods must be objectively justified by the processing purpose and formally documented.

Open in interactive reader

⚖️ Lifecycle Regulation 📋 Active vs Archive Phasing

Storage Limitation & Lifecycle (Art. 5.1.e)

⚡ In 30 seconds

Under Article 5(1)(e), personal data must be kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed. Once the purpose is exhausted, data must be permanently erased or anonymised, unless statutory archiving rules apply.

Phase	Characteristics & Storage Conditions	Access Policy
1. Active Base	Immediate operational use (active contract, ongoing customer support).	Direct access for authorized operational business teams.
2. Intermediate Archive	Fulfills statutory accounting/tax rules or legal limitation periods.	Restricted access; isolated database partition; DPO/Legal oversight.
3. Permanent Erasure	Purposes and legal statutory periods have expired.	Definitive cryptographic destruction or irreversible anonymisation.

⚡ Key Takeaways

Three-phase data lifecycle: Active Base → Intermediate Archive → Erasure.
Scientific research and statistical archiving enjoy specific derogations under Article 89(1).
Retention schedules must be transparently communicated in privacy notices (Art. 13.2.a).

⚠️ Common Pitfall

Keeping CVs of unselected job candidates for decades without refreshing consent or applying a 2-year purge policy.

🛠️ In Practice

Configure automated cron jobs to purge soft-deleted records past their legal retention threshold.

⚖️ Official Sources: Art. 5(1)(e), 17, 89(1) GDPR · Recital 39 ✓ Legal review: 23 August 2026