Is it true that if I encrypt personal data I don't have to delete it when the retention period ends?

No. This is a common misconception, and acting on it can create real legal and privacy exposure. Encryption is a security control, not a disposition method. When a retention period ends, the obligation is to dispose of the information — and encrypted data that still exists has not been disposed of.

Encryption and retention answer different questions

These are two separate disciplines that are easy to conflate:

• Encryption protects data while you are keeping it. It reduces the risk that unauthorized parties can read the data if it is lost, stolen, or breached.
• Retention and disposition govern whether you are allowed to keep it at all. A retention schedule says how long a record must be kept and what happens when that period ends — which is usually destruction or transfer.

Keeping personal data encrypted does not shorten or satisfy the retention clock. The record still exists, you still control it, and you are still accountable for it.

Why “encrypt instead of delete” is risky

Holding onto personal data past its authorized period — even encrypted — can work against you:

• It is still discoverable and disclosable. Encrypted records remain subject to litigation holds, subpoenas, and access requests. You may have to decrypt and produce them.
• It is still a breach liability. Encryption keys can be lost or compromised. Data you should have destroyed can still be exposed.
• It conflicts with data minimization. Privacy frameworks emphasize retaining personal data only as long as needed for a defined purpose. Indefinite retention, encrypted or not, undercuts that principle.

The defensible approach

• Follow your approved retention schedule, not the convenience of “just keep it encrypted.”
• When the period ends, carry out disposition — typically secure destruction so the data is irrecoverable. For encrypted data, that can include destroying the encryption keys (crypto-shredding) plus deleting the ciphertext, performed and documented as a deliberate disposal action.
• Document what was destroyed, when, and under what authority, so your disposition is auditable and defensible.

Treat encryption as protection for data you are authorized to hold, and retention rules as the authority that decides when holding must stop. For more, see the privacy and PII topic hub.

Where specific laws or regulations apply to your records, confirm the exact retention and disposal requirements with counsel or your records officer.