How long should I keep records containing personal data?

The guiding rule is simple: keep records containing personal data only as long as you need them for the purpose you collected them and to satisfy your legal obligations — and then dispose of them. This is the privacy principle of storage limitation, and it maps directly onto good records management.

There’s no single number

Just as with records generally, the right period depends on the type of record and the laws that apply:

• Some records containing PII have mandated minimums (e.g., certain employment, tax, or health records).
• Others should be kept only for the active purpose and disposed of soon after.
• Sensitive categories (health, financial, biometric) often warrant shorter, carefully justified retention because the risk of holding them is higher.

Your retention schedule should set a specific period for each record series that contains personal data, grounded in those requirements.

Why keeping less is safer

Holding personal data longer than necessary is a liability, not a safe default:

• It increases breach exposure — more sensitive data to lose.
• It expands compliance burden under privacy laws (GDPR, the Privacy Act, state laws).
• It adds discovery cost and risk in litigation.

Data minimization — and disposing of personal data on schedule — directly reduces all of these.

The practical answer

1. Know what personal data you hold and where (a records inventory).
2. Set a retention period for each type, based on purpose and legal requirements.
3. Dispose of it defensibly when that period ends — and be able to honor deletion requests where the law grants them.

In short: keep personal data exactly as long as you must, no longer — and treat its disposal as a privacy control, not an afterthought.