How long can personal data be kept? How to make a retention plan

Published 13 November 2026

Summary: Under Article 5(1)(e) of the GDPR, personal data may not be kept in identifiable form for longer than is necessary for the purposes. The GDPR sets no fixed periods; the purpose decides, and sometimes another law requires the data to be kept. Under the Swedish Bookkeeping Act, accounting information must be kept until the end of the seventh year after the end of the calendar year in which the financial year ended, and IMY (the Swedish Authority for Privacy Protection) says that email accounts and website details of former employees should normally be removed within one month. For most other data the retention period is an assessment that you justify in a retention plan and carry out in your systems.

What the GDPR says about retention

The storage limitation principle in Article 5(1)(e) says that personal data shall be “kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed”. The article allows longer storage where the data are processed solely for archiving in the public interest, research or statistics, with appropriate safeguards. Recital 39 says that the controller should establish time limits for erasure or for a periodic review.

The retention period returns in several places:

• Article 5(2): you must be able to demonstrate that the principle is followed.
• Articles 13(2)(a) and 14(2)(a): data subjects must be told the storage period or the criteria for it.
• Article 30(1)(f): the record of processing activities must, where possible, contain the time limits for erasure.
• Article 17(1)(a): data that are no longer necessary for the purposes must be erased without undue delay.
• Article 25(2): data protection by default expressly covers the period of storage.

So there is no general period in the GDPR, and one standard period for all data is not the assessment the regulation requires.

When another law requires you to keep data

The right to erasure does not apply to the extent that processing is necessary for compliance with a legal obligation (Article 17(3)(b)) or for the establishment, exercise or defence of legal claims (Article 17(3)(e)).

Accounting records

The Swedish Bookkeeping Act (bokföringslagen, 1999:1078), Chapter 7, Section 2 (7 kap. 2 §), says that documents holding accounting information must be kept “until the end of the seventh year after the end of the calendar year in which the financial year ended” (our translation). If the financial year ends on 31 December 2026, the records must therefore be kept until 31 December 2033. IMY points out that such documents, once no longer in use, should be kept apart from daily operations. The obligation covers the accounting information, not everything in the same system.

Public authorities and municipal companies

According to IMY, employers that are public authorities must preserve official documents unless there is support for disposal, for example in disposal regulations. Under the Archives Act (arkivlagen, 1990:782), Section 2 a (2 a §), the rules for municipal authorities’ archives also apply to companies over which municipalities or regions exercise a legally decisive influence (Public Access to Information and Secrecy Act, Chapter 2, Section 3 (2 kap. 3 §)). For municipal companies the retention plan must therefore match the archive rules and the company’s disposal decisions.

Common cases and what actually applies

The table only states periods that a law or IMY gives; otherwise it says that it is an assessment.

Data	What applies	Source
Accounting information, for example invoices and vouchers	Kept until the end of the seventh year after the end of the calendar year in which the financial year ended	Bookkeeping Act, Chapter 7, Section 2 (7 kap. 2 §)
Former employees’ email accounts and details on the website	Removed as soon as possible, normally within one month	IMY, employment
Job applicants who did not get the job	As long as the applicant can take legal action; keeping data for future recruitment requires consent	IMY, recruitment; Discrimination Act, Chapter 6, Section 4 (6 kap. 4 §)
Recorded camera surveillance footage	As short as possible; three days (72 hours) is a good rule of thumb, longer may be allowed for a concrete need	IMY; EDPB Guidelines 3/2019
Customers, contracts, marketing and support cases	The GDPR sets no period. Check whether a specific law applies to your sector; otherwise an assessment based on the purpose	Article 5(1)(e)

Job applicants in detail

IMY says that applications, interview notes and references may be kept as long as the applicant can take legal action. The Discrimination Act (diskrimineringslagen, 2008:567), Chapter 6, Section 4 (6 kap. 4 §), refers such disputes to the time limits in the Co-determination in the Workplace Act (medbestämmandelagen, 1976:580). For an applicant not represented by a trade union, an action must be brought within four months of becoming aware of the circumstance and at the latest within two years of its occurrence (Section 66, second paragraph (66 § andra stycket)). If the applicant is represented by a union, time limits for negotiation and action apply that can make the period longer. So the law sets no retention period; yours is an assessment to justify and document.

How to make a retention plan

1. Start from the record of processing activities. Each processing activity, and sometimes each category of data within it, needs a retention period.
2. Decide what starts the clock: end of employment, end of contract, end of the financial year, closed case or last contact. A period without a starting point cannot be carried out.
3. State the basis for the period: a law with its section, guidance from IMY, or your own assessment with reasons. The reasons are what show that you comply with Article 5(2).
4. Decide what happens when the period ends (erasure, anonymisation or separation into an archive with restricted access), who does it and how often, for example automatically every night or manually once per quarter.
5. Adopt and anchor: have process owners and, where needed, management approve the plan, and carry the periods into the record of processing activities and the information you give data subjects.

In our division of the GDPR into 15 parts, this is part 9, retention and storage periods. It builds directly on the record of processing activities (part 8).

Deleting in practice

A retention plan only counts if it is carried out in the systems:

• Use the systems’ deletion features, test that they actually delete and log the deletion carried out.
• Do not forget the copies: email attachments, exports to spreadsheets, shared folders and local downloads.
• Backups are in practice often cleared only when the copy expires. Document how long they are kept and how deleted data are handled if an older backup has to be restored, so that they are not reinstated as live data for longer than necessary.
• Anonymisation replaces erasure only if people can no longer be identified by means reasonably likely to be used. Under Recital 26, pseudonymised data are still personal data.
• Suppliers: under Article 28(3)(g) the processor must delete or return the data when the service ends, at your choice. Ask for confirmation.

Three common mistakes

• One period for everything. Seven years is taken from the Bookkeeping Act and applied to data that are not accounting information.
• Keeping data just in case. IMY says that it is not permitted to collect personal data for undefined future needs because they may be “good to have”.
• Periods on paper. The period is in the privacy information but never carried out in the systems.

What you have when the retention plan is done

• A retention period, a starting point, a basis and an action for each processing activity or category of data.
• Periods that match the record of processing activities and the privacy information.
• A log showing that deletion is carried out, and an answer when a data subject, a customer or IMY asks how long you keep the data.

If you first want to see where you stand, start with our GDPR self-test.

Would you like help setting the retention periods? In GDPR Start we produce a retention plan with retention periods together with the record of processing activities and the privacy information, so that the periods match everywhere and can be carried out. Read more about our work with data protection and privacy or contact us.

Sources: Regulation (EU) 2016/679 (GDPR), Articles 5, 12–14, 17, 25, 28 and 30 and Recitals 26 and 39; Swedish Bookkeeping Act (bokföringslagen, 1999:1078); Discrimination Act (diskrimineringslagen, 2008:567); Co-determination in the Workplace Act (medbestämmandelagen, 1976:580); Archives Act (arkivlagen, 1990:782); Public Access to Information and Secrecy Act (offentlighets- och sekretesslagen, 2009:400); Swedish Authority for Privacy Protection (IMY), guidance on basic principles, employment, recruitment and camera surveillance; EDPB, Guidelines 3/2019 on video devices. Verified 2026-10-03.

This text is general information and not legal advice. Which retention periods apply to you depends on your purposes, your sector and the laws that apply to you, and needs to be assessed in the individual case.