Storage Limitation
Art. 5(1)(e) GDPR — erasing data once the purpose has been achieved
TL;DR
Personal data may not be stored for longer than is necessary for the processing purpose. Once the purpose has been achieved: erasure or anonymisation — unless statutory retention obligations apply (e.g. § 257 HGB, § 147 AO).
What is storage limitation?
The storage limitation principle (Art. 5(1)(e) GDPR) applies uniformly across the EU. The specific retention periods, however, follow from national tax and commercial law and differ between Germany and Austria.
Germany
- Tax and commercial records: 10 years (§ 147 AO, § 257 HGB)
- Payroll accounts: 6 years (§ 41 EStG)
- Applicant data where no employment follows: 6 months after rejection (practical value, not a statutory period; covers the two-month period under § 15(4) AGG)
- Marketing consents: for as long as the consent applies, then 3 years for evidence purposes (practical value, not a statutory period)
- Cookie data: max. 12 months (practical value, not a statutory period; consent under § 25(1) TDDDG)
Austria
- Accounting and business records: 7 years (BAO § 132(1), UGB § 212(1)) — not 10 years as in Germany
- Cookie data: active, informed consent (§ 165(3) TKG 2021); the competent supervisory authority is the Austrian Data Protection Authority (Datenschutzbehörde, DSB), not the German Data Protection Conference (DSK)
Practical example
HR software stores applications. After a rejection, the data are erased after 6 months (practical value, not a statutory period; by then the two-month period under § 15(4) of the German General Equal Treatment Act (AGG), running from receipt of the rejection, has expired). Exception: the applicant consents to a talent pool — longer storage is then possible.