How long can an organisation keep my data?

Only as long as the purpose it was collected for continues to be served, unless retention is required by law. Once the purpose is spent and no legal retention obligation applies, the Data Fiduciary must erase the data and cause its Processors to do so. The Rules prescribe specific retention limits for certain classes of Data Fiduciary above defined user thresholds, after which data must be erased following notice to the individual. In practice, many sectors carry minimum retention obligations that pull the other way: anti money laundering and KYC rules require financial records to be kept for years, tax and company law impose their own periods, and securities, insurance and health regulators each set retention floors. Where a statutory retention duty applies, it generally prevails over an erasure request, and organisations should be able to point to the specific provision they are relying on.