This clause sets out exactly how long the other party will keep your data before deleting it—for example, "customer records kept for 3 years after the contract ends, then deleted." This matters because GDPR's "storage limitation principle" (Article 5) requires companies to keep personal data only as long as necessary; keeping it longer than needed is a breach. US laws like HIPAA (for health data) also impose specific retention rules. For example, a gym cannot legally keep your payment details for 10 years after you cancel your membership if they only need them for 2 years for tax purposes.
Negotiate this carefully based on your actual business needs—do not accept "indefinite" retention. Agree on a specific timeframe (e.g., "3 years after contract termination") and confirm the clause says data will be "deleted" or "securely destroyed," not just "archived" (which is different and may not comply with data protection law). ---
Frequently Asked Questions
What does this clause mean in simple terms?
This clause sets out exactly how long the other party will keep your data before deleting it—for example, "customer records kept for 3 years after the contract ends, then deleted." This matters because GDPR's "storage limitation principle" (Article 5) requires companies to keep personal data only as long as necessary; keeping it longer than needed is a breach.
Why should I care about this clause?
US laws like HIPAA (for health data) also impose specific retention rules.
What are my options?
For example, a gym cannot legally keep your payment details for 10 years after you cancel your membership if they only need them for 2 years for tax purposes.