What are the penalties for keeping PII longer than your retention schedule allows under GDPR?

Under the EU General Data Protection Regulation (GDPR), keeping personal data longer than necessary is not a minor housekeeping lapse — it is a breach of a core principle. Article 5(1)(e), the “storage limitation” principle, requires that personal data be kept in identifiable form no longer than is necessary for the purposes for which it was processed. Holding personally identifiable information (PII) past the point of legitimate need, or beyond what your retention schedule and applicable law allow, can expose an organization to enforcement.

What the penalties look like

GDPR uses a two-tier fine structure. Breaches of the basic data-protection principles — which include storage limitation — fall into the higher tier. In general terms, that tier allows administrative fines of up to the greater of a fixed maximum (in the tens of millions of euros) or a percentage of the organization’s total worldwide annual turnover. The lower tier, for more procedural failings, carries a smaller ceiling. Because over-retention touches a foundational principle, regulators may treat it under the higher tier.

Fines are not the only consequence. Supervisory authorities can also:

• Issue reprimands, warnings, and binding compliance orders.
• Order erasure of the unlawfully retained data.
• Temporarily or permanently ban further processing.

Individuals whose data was retained too long may also seek compensation, and reputational damage often outweighs the monetary penalty.

How regulators decide

Fines are discretionary and proportionate, not automatic. Authorities weigh factors such as the nature and gravity of the violation, whether it was negligent or intentional, the volume and sensitivity of the data, mitigating steps taken, and the organization’s history of cooperation. A documented, enforced retention schedule — and evidence that you actually dispose of data on time — is a strong mitigating factor.

Reducing your exposure

The practical defense is disciplined records management: define lawful retention periods tied to a clear purpose, document them, and execute defensible disposition when periods expire. Frameworks like the NIST Privacy Framework and recognized records standards such as ISO 15489-1 help structure these controls.

This is general guidance, not legal advice; consult qualified counsel for your jurisdiction and circumstances.

Learn more at the privacy and PII topic hub.