Does GDPR override a company's own retention schedule for keeping employee or customer data?

The short answer is that GDPR does not simply “override” a retention schedule, and a retention schedule does not override GDPR. They are meant to work together. A well-built schedule reflects the law; GDPR is one of the legal inputs that shapes how long you may keep personal data about employees and customers.

What GDPR actually requires

GDPR (the EU General Data Protection Regulation) applies to personal data of individuals in the EU and EEA, and to many organizations outside the EU that handle that data. Two of its principles matter most for retention:

• Storage limitation — personal data should not be kept in an identifiable form for longer than is necessary for the purpose it was collected.
• Data minimization — you should hold only the personal data you actually need.

In practice this means GDPR sets an upper bound and a justification test. You must be able to explain why you still hold someone’s data and when you will dispose of it.

How it interacts with a retention schedule

A retention schedule is your organization’s documented decision about how long each record series is kept and what happens at the end. GDPR does not replace it — it informs it. Where they appear to conflict, work through this order:

1. A specific legal retention duty wins. If another law requires you to keep certain records for a set period (tax, payroll, employment, accident records), GDPR generally recognizes that obligation as a lawful basis to retain.
2. Where no law mandates retention, GDPR’s storage-limitation principle governs. You should set the shortest defensible period tied to a documented purpose, not keep data indefinitely “just in case.”
3. At end of retention, dispose or anonymize so personal data is no longer identifiable.

Practical takeaways

• Treat GDPR as a driver of your schedule, alongside other statutes — not a separate, conflicting rulebook.
• Document the purpose and legal basis behind each retention period.
• Build defensible disposition into the schedule so data does not linger past its justification.

Different jurisdictions and sectors carry their own retention laws, so confirm requirements with qualified legal counsel for your situation. For related guidance, see the FOIA and public records hub.