The Retention Period
The response states how long the organisation will keep the person's personal data, or the criteria it uses to decide.
Intent
How long the organisation keeps the data tells the person when it will be gone, and whether to ask for erasure now.
How to test it
An assessor scores the criterion against a single response:
- Score 2
- The response gives a retention period, or the criteria the organisation applies to decide when the data is deleted.
- Score 1
- The response says the data is kept as long as necessary, with no period and no criteria.
- Score 0
- The response says nothing about how long the data is kept.
The law it reflects
This criterion reflects Article 15(1)(d) of the UK GDPR. That mapping is a guide, not a legal test: conformance is judged against the criterion, not the article.
See E4 in context in the full standard.