How long can personal information be retained? While global privacy laws do limit the retention of personal information, this does not mean that personal information must be deleted after only a year, for example. Organizations should establish a business justification process which documents the legitimate need for personal information retention. At a minimum, such a process shows good-faith effort at following the rules.<\/p>\n
Companies should take a \u201cgoldilocks\u201d approach in determining this retention. It need not be too short, nor too long, but rather following a middle period based on reasonable justification:<\/p>\n
Periods<\/em> \u2013 Legal and regulatory recordkeeping requirements trump privacy rules. In the example from the previous section, California requires that \u201cany and all applications, personnel, membership, or employment referral records and files; personnel files of applicants or terminated employees\u201d be retained for four years. As such all such records such have a minimum four-year retention after the records\/files are initially created\/received, or four years after the date the employment action was taken. Records retention requirements serve as a \u201clow water mark\u201d retention period.<\/p>\n Companies May Retain Personal Information for a Longer Period Through Business Justification \u2013 There are many instances in which companies have a legitimate business need to retain personal information longer<\/p>\n than legal and regulatory requirements. Personal information may be retained for these longer periods, so long as there is a reasonable business justification. This justification should be documented in the data retention policy (see below).<\/p>\n Business Justification Must be Reasonable \u2013 The ability to save personal information through a business justification process does not give license for an organization to save personal information longer than reasonable. For example, many companies have significant stores of personal information saved in data warehouse and other similar types of applications, some which contains personal information which may be literally 10 or 20 years old. (See box below). While this personal information may be useful for marketing purposes, it is difficult to see how this retention would be needed for business purposes supporting the sales to a customer.<\/p>\n