GDPR Data Retention Periods: A Practical Cheatsheet for Dutch Businesses

The GDPR's storage limitation principle (Article 5(1)(e)) is simple in theory: keep personal data only as long as necessary. In practice, "necessary" depends on the purpose, the type of data, and other legal obligations that may require you to keep records longer than you otherwise would.

The Netherlands adds its own layer: Dutch tax law (Belastingwet), employment law (Burgerlijk Wetboek), and sector-specific regulations all set their own mandatory retention periods that interact with GDPR rules.

The Golden Rule

You cannot keep personal data indefinitely just because it might be useful someday. The GDPR requires:

1. A defined purpose for collecting the data
2. A defined retention period linked to that purpose
3. Actual deletion or anonymisation when the period expires

A privacy policy that says "we keep your data as long as necessary" without specifying a period does not meet the requirement. You must state actual timeframes.

Retention Periods by Category

Financial and Tax Records

Financial records have a minimum — you must keep them. The GDPR's purpose limitation means you cannot use financial records for marketing or other unrelated purposes after the primary accounting purpose is served.

Customer Relationship Data

Website and Analytics Data

Marketing and Email

Dutch direct marketing via email requires either prior consent or existing customer relationship (soft opt-in). Either way, the email address must be deleted promptly on unsubscribe.

HR and Employment Records

For rejected job applicants, 4 weeks is the standard. You may ask candidates to consent to keeping their CV for up to 1 year for future roles, but this consent must be specific and freely given.

Contact Forms and Enquiries

Health and Special Category Data

Special category data (Article 9 GDPR) — including health data, dietary requirements, disabilities, and religious or political beliefs — requires a higher standard of justification to retain.

Dutch-Specific Retention Requirements

Fiscal Unity: The 7-Year Rule

The Dutch Tax and Customs Administration (Belastingdienst) requires businesses to keep all records relevant to their tax position for 7 years from the end of the financial year in which they were created. This applies to:

• Invoices (both sent and received)
• Bank statements
• Stock records
• Wage administration

For real estate records: 10 years.

Consumer Dispute Records

The ACM (Autoriteit Consument & Markt) recommends retaining records relevant to consumer complaints until the statutory limitation period expires. Most consumer claims have a limitation period of 2 years from delivery, or up to 5 years for personal injury claims.

How to Implement Retention Periods

Step 1: Map your data

List every type of personal data your business collects. Include website analytics, customer records, HR data, financial records, and any third-party tools that receive data.

Step 2: Define a retention period for each

Use the table above as a starting point. Where law dictates a minimum (tax records), honour that minimum. Where there is no legal minimum, define the shortest period that serves your business need.

Step 3: Document it

Add retention periods to:

• Your processing register (Article 30 GDPR)
• Your privacy policy (visible to website visitors)
• Internal data management procedures

Step 4: Automate deletion where possible

Manual deletion processes fail. Most CRM, email, and analytics tools have automatic deletion or anonymisation settings. Configure them. Google Analytics 4 defaults to 14 months — confirm this is set in your account.

Step 5: Review annually

Retention periods change as your business changes. Review your data map and retention schedules each year, or when you add a new service or tool that processes personal data.

What Happens If You Keep Data Too Long?

The AP can fine businesses for violating the storage limitation principle. In practice, the AP usually discovers this violation in the context of a broader investigation — a data breach, a complaint, or a routine audit — rather than proactively auditing retention periods in isolation.

But the reputational damage from a breach of data that should have been deleted long ago is real. If old customer data is stolen or leaked, and it turns out you had no business reason to still hold it, the AP will treat this as an aggravating factor.

To see what personal data your website is currently collecting, scan your website free.

---

This article is technical analysis, not legal advice. Consult a lawyer for advice specific to your situation.