Data Retention Policy

A data retention policy sets out which personal data a business keeps, for how long, and how and by whom it is deleted. It puts the GDPR principles of storage limitation and data minimisation (Article 5) into practice and balances them against statutory retention periods, for example for tax records.

What is a data retention policy?

A data retention policy (sometimes called a deletion concept or retention schedule) is a written rule set that answers three questions for every type of personal data you hold: how long do we keep it, why, and how does it get deleted?

It puts two principles from Article 5 of the GDPR and the UK GDPR into practice:

  • Storage limitation (Article 5(1)(e)): personal data may be kept in an identifiable form no longer than necessary for the purpose it was collected for.
  • Data minimisation (Article 5(1)(c)): you collect and keep only what you actually need.

It also supports individual rights. When someone asks for their data to be erased under Article 17, a clear policy tells your team what can be deleted right away and what must be kept for legal reasons.

Why it matters: purpose versus retention periods

The tricky part is that two obligations pull in opposite directions. The GDPR says: delete once the purpose is fulfilled. Tax, company and employment law say: keep certain records for years. In the UK, many business and accounting records are generally kept for six years; in Germany, retention periods for accounting documents run up to ten years. Customer chats that are part of a contract or a quote can fall under these rules too.

A good retention policy defines, for each data category:

  • The trigger: when does the clock start? End of contract, last contact, completion of a job?
  • The period: how long, and on what basis (purpose, law, limitation period for claims)?
  • The method: deletion, anonymisation or restricted access until the period ends.
  • Responsibility: who checks and who deletes, and how often?

The retention policy is part of your technical and organisational measures, and its periods belong in your records of processing activities. Fixed routines, such as a monthly review date, make it far less likely that data is forgotten in old inboxes or on personal phones.

Example: a letting agency in Cardiff

A letting agency in Cardiff talks to prospective tenants and landlords on WhatsApp, SMS and email. Its retention policy sets clear rules:

  • Enquiries that do not lead to a tenancy: deleted six months after the last contact.
  • Viewing reminders: deleted 30 days after the viewing.
  • Conversations that are part of a tenancy: kept for six years after the tenancy ends, because they can matter for disputes and accounting.
  • Erasure requests: handled within the one-month deadline, with a note of what had to be kept and why.

Once a month, the office manager runs through the list and deletes what has expired. Because every channel lands in one central system rather than on individual phones, nothing is missed.

Data retention with SendSeven

SendSeven helps you apply your policy, while the policy itself stays your decision:

  • One central place: contacts and conversations from all channels are in one unified inbox instead of on private devices.
  • Delete individual records: remove a contact or a conversation when its period has expired or when someone asks for erasure.
  • Export before deleting: conversations can be exported as PDF, for example when a record has to be kept elsewhere.
  • Hosted in the EU (Frankfurt), encrypted in transit and at rest, with a DPA under Article 28.

Keep in mind that messages sent through WhatsApp, Instagram or Messenger are also processed by Meta under its own terms, and deleting a conversation in SendSeven does not delete it from the customer’s phone. Learn more about managing contacts in contact management.

This is general information, not legal advice. Check the details with your data protection lead or compliance consultant.