What does storage limitation mean under GDPR?

Article 5(1)(e) of the GDPR, the storage limitation principle, says personal data must not be kept in identifiable form for longer than necessary for the purpose it was collected. In practice the necessary period is often set by other laws, such as tax or employment limitation periods.

How are the retention periods chosen?

Each combination of jurisdiction and category maps to a well-established statutory baseline, for example six years for UK accounting records under the Companies Act, or six years for HIPAA documentation. The tool cites the governing rule for each result.

When does the retention clock start?

It depends on the data. Financial records usually run from the end of the accounting period, while HR and contract data typically run from the end of the employment or relationship. Set the collection date accordingly to get an accurate deletion date.

Why do some categories have no fixed period?

Marketing consent data has no single statutory retention period. Instead you must keep it only while consent remains valid and honour opt-outs, so the rule is to review and purge regularly rather than count down to a fixed date.

Is this legal advice?

No. These are common baselines for general planning. Actual obligations vary by sector, contract, and individual member state, and several health and financial periods are longer in specific countries. Confirm your retention schedule with a qualified adviser.

Data Retention Period Calculator

Holding personal data too long is a compliance risk; deleting it too early can breach a different legal duty. The lawful window sits in between, and it depends on what the data is, where you operate and when the clock started. This calculator pins down the earliest date you can safely delete a given category and cites the rule behind it.

How it works

You choose a jurisdiction and a data category, and the tool looks up a representative statutory retention period, then adds it to your start date:

deletionDate = startDate + retentionPeriod(jurisdiction, category)

It then shows how many days remain in the window, the legal basis, and the citation. If the period has already elapsed, it tells you the data is safe to delete.

The baselines used

Category	UK	EU	US (HIPAA / federal)
HR / employment	6 years (Limitation Act 1980)	3 to 6 years (national law)	1 year (3 for payroll, FLSA)
Financial	6 years (Companies Act / HMRC)	up to 10 years (VAT Directive)	up to 7 years (IRS / SOX)
Health	8 years (NHS Code)	~10 years (national law)	6 years (45 CFR 164.316)
Marketing	review (storage limitation)	review (storage limitation)	honour opt-out (CAN-SPAM/TCPA)

These are common, widely cited figures. Several health and financial periods are longer in specific member states, which the result notes flag.

When the clock starts

The start date matters as much as the period. Financial records generally run from the end of the relevant accounting period, while HR and contract data run from the end of the employment relationship rather than the day the data was first collected. Set the collection date to whichever event applies.

Important

This is general guidance to help you draft a retention schedule, not legal advice. Obligations vary by sector, by contract and by individual country, and some regimes impose longer or sector-specific periods. Confirm your final policy with a qualified data protection or legal adviser. All calculation runs locally in your browser and no data you enter is transmitted.