Can a company be penalized for keeping data too long under privacy laws even if nothing was breached?

Yes. Under many modern privacy regimes, keeping personal data longer than you can justify is itself a violation — independent of whether that data is ever exposed in a breach. A breach is one kind of harm; over-retention is a separate compliance failure that regulators can act on directly.

Why “no breach” doesn’t mean “no risk”

Privacy laws are generally built around the principles of purpose limitation and storage limitation: you may collect and hold personal data only for a defined, legitimate purpose, and only for as long as that purpose requires. Once the purpose ends and no legal hold or retention obligation applies, continued storage has no lawful basis. That status — holding data with no valid reason — is what enforcement targets, regardless of how well the data is secured.

In practice, regulators have penalized organizations for retaining personal records far beyond any operational or legal need, even where the data was never accessed by an outsider. The reasoning is straightforward: data you no longer need is pure liability and an ongoing intrusion on the individuals it describes.

How over-retention becomes a finding

• Audits and individual requests. Subject-access or deletion requests can surface data that should have been disposed of years earlier.
• Inconsistent practice. A written retention policy that the organization doesn’t actually follow can be worse than none, because it documents the gap.
• No defensible basis. If you can’t point to a purpose, a statute, or a litigation hold, you can’t justify keeping the record.

What good governance looks like

The discipline that prevents this is records management, applied to personal data:

• Maintain a retention schedule mapping each data category to a defined keep-and-destroy timeline.
• Practice data minimization — collect less, and dispose on schedule through routine, documented destruction.
• Suspend disposition only under a valid legal hold, and release it when the matter closes.
• Keep evidence of disposition so deletion is provable.

Frameworks such as the NIST Privacy Framework and the ISO 15489 records-management standard treat timely, defensible disposition as a core control — not an afterthought. Deleting data you no longer need is one of the cheapest and most effective ways to reduce both privacy exposure and breach impact.

For more, see the Information Governance topic hub.

This is general educational information, not legal advice; consult counsel for obligations specific to your jurisdiction and industry.