What customer data may be stored, for how long, and what must be told?

In brief

Customer data may be stored when it is personal data needed for a specific and lawful purpose, and when one legal basis in the General Data Protection Regulation (GDPR) applies. You may not keep customer data just in case, because the GDPR’s Article 5 requires data minimisation and storage limitation. There is no single GDPR retention period for all customer data; the period depends on why the data is processed, or on clear criteria if the exact period cannot be named. The customer must be told, in clear language, who processes the data, why it is processed, what legal basis is used, how long it is kept, who receives it, and which rights the customer has.

Customer data is personal data when a person can be identified

A customer record is personal data when it relates to an identified or identifiable living person. The GDPR’s Article 4 gives examples such as a name, a personal identity code, location data and online identifiers.

In everyday work, this means that a customer’s name, email address, phone number, delivery address, customer number, complaint message or login identifier can be personal data. A single detail may identify the person directly. A combination of details may identify the person indirectly.

The same Article 4 also defines processing widely. Processing includes collecting, recording, organising, storing, changing, retrieving, using, disclosing, deleting and destroying personal data. So the question is not only what may be collected. It is also what may be entered into a customer relationship management system, kept in an inbox, exported to a spreadsheet, shared with a supplier or deleted.

A controller is the organisation that decides the purposes and means of processing. A processor handles personal data on behalf of the controller. If a service provider stores the customer database for the organisation, the role question matters. The topic continues in Controller or processor: when a data processing agreement is needed and what Article 28 requires.

Storage needs a purpose and a legal basis

The GDPR’s Article 5 requires that personal data is collected for specified, explicit and legitimate purposes. A purpose is the practical reason for using the data. For example, sending a purchased service to a customer is a purpose. Handling a customer complaint is another purpose.

The GDPR’s Article 6 then requires a legal basis. Processing is lawful only if at least one Article 6 condition applies. The legal bases are:

• consent from the data subject for one or more specific purposes;
• necessity for a contract with the data subject, or steps before a contract at the data subject’s request;
• necessity for a legal obligation of the controller;
• necessity to protect vital interests;
• necessity for a task carried out in the public interest or in the exercise of official authority;
• necessity for legitimate interests pursued by the controller or a third party, unless the data subject’s interests or fundamental rights override them.

Article 6 also says that the legitimate interests basis does not apply to processing carried out by public authorities in the performance of their tasks. A municipality therefore needs special care when choosing the legal basis for customer or resident data.

The basis must match the actual work. If data is needed to deliver a service ordered by the customer, the contract basis may be relevant. If the organisation processes data because a law requires it, the legal obligation basis may be relevant. If the organisation wants to use data for another later purpose, Article 6 requires a compatibility assessment unless the new processing is based on consent or on Union or Member State law that meets the Article’s conditions. The legal basis question continues in What legal basis permits processing personal data?.

The amount stored is limited to what is necessary

The GDPR’s Article 5 states the principle of data minimisation. Customer data must be adequate, relevant and limited to what is necessary for the purposes of processing.

This is a practical test for every form, system field and free-text note. If the purpose is to deliver a product, a delivery address may be necessary. If the purpose is to send a service notice by email, a date of birth may not be necessary. If a free-text field invites employees to write opinions about a customer, the field can create unnecessary and inaccurate data.

A useful internal question is: would the purpose fail without this data item? If the answer is no, the organisation needs a strong reason to store it.

Work situation	GDPR question	Practical result
A customer opens an account	What data is necessary for the account purpose?	Mandatory fields should match that purpose.
A customer service employee writes a note	Is the note relevant and accurate for handling the matter?	Notes should describe facts needed for the case.
A mailing list is created	Which legal basis applies to this use?	Contact details should not be reused without checking the purpose and basis.
Old customer data remains in a system	Is the data still necessary for the original purpose?	Retention should be reviewed against the purpose.

Article 5 also requires accuracy. In practice, wrong contact details, old preferences or an incorrect complaint status should be corrected or removed without undue delay when they are inaccurate for the purpose. For a plain-language explanation of the principles, see What do the GDPR's six principles mean at work?.

Special categories of personal data are generally prohibited

Some customer data creates a higher risk because it tells something especially sensitive about the person. Article 9 of the GDPR covers special categories of personal data. These include data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data used for unique identification, health data, and data concerning a person’s sex life or sexual orientation.

The starting point in Article 9 is prohibition. These data categories may be processed only when one of the Article 9 exceptions applies. The exceptions include, among others, explicit consent for specific purposes, vital interests where the person cannot give consent, data made manifestly public by the data subject, legal claims, important public interest based on law, certain health and social care purposes, public health reasons, and archiving, research or statistical purposes under the conditions in the Article.

For daily customer work, this means that health details, disability information, biometric identifiers or political opinions should not be added to a customer record unless the organisation has identified both an Article 6 legal basis and an Article 9 exception. A customer may mention sensitive information in a message. That does not automatically mean the organisation may store it widely or use it for a new purpose.

The retention period is not one ready-made number

The GDPR does not set one retention period for all customer data. Article 5 says personal data must be kept in a form that identifies the data subject only for as long as necessary for the purposes of the processing.

This means retention starts from the purpose. Data needed to handle an active customer relationship may have a different retention need from data needed to answer a complaint. Data used for a one-time request may no longer be needed after the request has been handled. The GDPR rule is not “keep everything for safety”. It is “keep what is necessary for the purpose”.

Articles 13 and 14 add a transparency duty. The customer must be told the retention period. If that is not possible, the customer must be told the criteria used to determine the period. Criteria can be easier to manage when the exact end date depends on the customer relationship, the matter being handled or another defined event.

Article 5 allows longer storage when personal data is processed only for archiving in the public interest, scientific or historical research, or statistical purposes, if the required technical and organisational measures protect the rights and freedoms of data subjects. This is not a general permission to keep ordinary customer data indefinitely. It is tied to those purposes and safeguards.

The customer must be told about processing clearly

Transparency is a core GDPR duty. Article 12 requires information to be concise, transparent, intelligible, easily accessible, and written in clear and plain language. This matters especially when information is directed to a child.

When data is collected directly from the customer, Article 13 requires the controller to provide the information at the time the data is obtained. The information includes:

• the controller’s identity and contact details;
• the data protection officer’s contact details, where applicable;
• the purposes of processing and the legal basis;
• the legitimate interests, if that legal basis is used;
• recipients or categories of recipients;
• information on transfers to a third country or an international organisation, where relevant;
• the retention period or the criteria used to determine it;
• the rights to access, rectification, erasure, restriction, objection and data portability;
• the right to withdraw consent, if processing is based on consent;
• the right to lodge a complaint with a supervisory authority;
• whether providing the data is a statutory or contractual requirement or necessary for a contract, and the consequences of not providing it;
• the existence of automated decision-making, including profiling, and meaningful information about its logic, significance and consequences in the cases covered by the Article.

When data is not obtained from the customer, Article 14 requires similar information. It also requires information on the categories of personal data and the source of the data. Article 14 sets timing rules: the information must be provided within a reasonable period and at the latest within one month, or at the first communication if the data is used to contact the customer, or at the first disclosure if the data is to be disclosed to another recipient.

If the controller plans to process the data later for another purpose, Articles 13 and 14 require the controller to tell the customer about that other purpose before the further processing starts.

Customer rights affect daily work

Customer rights are not only a legal department issue. They affect customer service, sales, support, administration and information technology.

Article 15 gives the data subject the right to know whether personal data about them is processed and to access that data. The customer can also receive information about purposes, categories of data, recipients, retention, rights, the source of data when it was not collected from them, and automated decision-making in the cases covered by the Article.

Article 16 gives the right to rectification. If customer data is inaccurate, the customer can require correction without undue delay. Incomplete data can also be completed, taking into account the purposes of processing.

Article 17 gives the right to erasure when one of the Article’s grounds applies. One ground is that the personal data is no longer needed for the purposes for which it was collected or otherwise processed. The right is not absolute. Article 17 also lists situations where erasure does not apply, including when processing is necessary for a legal obligation, a public interest task or legal claims.

Article 18 gives the right to restriction of processing in listed situations. A simple example is a dispute about accuracy. The data may need to be marked so it is not used while the controller checks whether it is correct.

Article 20 gives the right to data portability when the processing is based on consent or contract and is carried out by automated means. The data subject has the right to receive the personal data they provided in a structured, commonly used and machine-readable format. This right does not apply to processing necessary for a public interest task or official authority.

Article 12 sets the response time. The controller must provide information on action taken without undue delay and in any event within one month of receiving the request. The period may be extended by up to two further months when necessary because of the complexity or number of requests. The controller must tell the customer about the extension within one month and give the reasons for the delay. The request process continues in Data subject rights: when a customer asks for their data, you have a month.

Limits make the obligation understandable

The GDPR does not require the same answer in every customer process. It requires the organisation to know the purpose, legal basis, necessary data, retention logic, recipients and customer information for each processing activity.

The duty also has limits. Article 13 says the information duty does not apply if and to the extent that the data subject already has the information. Article 14 has a similar rule when data is not obtained from the data subject. Article 14 also lists other limits, including situations where providing the information proves impossible or would involve disproportionate effort in the specific cases described in the Article, where obtaining or disclosing the data is expressly laid down by law with appropriate measures, or where the data must remain confidential because of a legal duty of secrecy.

The rights also have limits. Erasure does not always override legal obligations, public interest tasks or legal claims. Data portability applies only under the conditions in Article 20. A request may require identity verification. Article 12 allows the controller to ask for additional information necessary to confirm identity if there are reasonable doubts about who made the request.

These limits do not remove the accountability duty. Article 5 says the controller is responsible for compliance with the principles and must be able to demonstrate it. In practice, decisions about what is stored, why it is stored and when it is deleted need to be explainable later.

A personal data breach changes the information duty

A personal data breach is a security breach that leads to accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data. Article 4 defines it this way. In everyday terms, it may be a misdirected customer email, lost customer files, unauthorised access to a customer database, or destroyed records that should still exist.

Article 33 says the controller must notify the competent supervisory authority without undue delay and, where feasible, within 72 hours after becoming aware of the personal data breach. This duty does not apply if the breach is unlikely to result in a risk to the rights and freedoms of natural persons. If the notification is not made within 72 hours, the controller must give reasons for the delay.

A processor must notify the controller without undue delay after becoming aware of a personal data breach. The controller must document all personal data breaches, including the facts, effects and remedial action taken, so that the supervisory authority can verify compliance with Article 33.

Article 34 creates a separate duty to inform the customer when the personal data breach is likely to result in a high risk to the rights and freedoms of natural persons. The information must be given without undue delay and in clear and plain language. It must describe the nature of the breach and include at least the contact point, likely consequences and measures taken or proposed.

Article 34 also lists cases where telling each affected customer is not required. These include situations where appropriate technical and organisational protection measures, such as encryption, made the data unintelligible to unauthorised persons; where later measures ensure the high risk is no longer likely to happen; or where direct communication would involve disproportionate effort and a public communication or similar measure informs people equally effectively. The 72-hour breach rule continues in Personal data breach: the 72 hours start when an employee notices.