Data retention periods for personal data

How long is the Data retention period?

How long can I keep data on clients who have cancelled their contract?
How long can I keep an employee's personal data, especially after they have left?

Data retention periods for personal data: what are they?

Personal data can only be kept for a limited period, which is set either by lawe.g laws, decrees, regulations), or directly by the French supervisory authority, the CNIL (National Commission for Information Technology and Civil Liberties)via recommendations, simplified standards, etc.

This is undoubtedly the most perilous and complex project to implement, since it involves raising awareness and providing in-house training for the departments concerned.

✅ Fortunately, more and more "business software", especially in the human resources sector, is finally starting to offer tools that automatically comply with the Data retention period for personal data.

However, not only is this not always the case, but many doubts may remain on a day-to-day operational basis as to the applicable Data retention period.

In this page you will be able to consult the duration of Data retention of personal data that apply in the fields of Human ResourcesSales Business Development and Marketing Marketingand Accounting and documents documents.

All the latest CNIL (National Commission for Information Technology and Civil Liberties) ) reforms and position statements from January 1, 2020 have been taken into account. 

Identify the duration of Data retention of personal data

To define the Data retention period for the personal data you process, it is necessary to carry out a compliance analysis of your processing operations. It should be noted, however, that regulations have set a Data retention period for certain types of processing. In other words, in certain cases, the duration of Data retention of personal data is fixed by articles. For example, article L3243-4 of the French Labor Code requires that an employee's payslip (considered here to be personal data) be kept for 5 years.

On the other hand, for the majority of personal data processing operations, the Data retention period is not imposed by any regulation or text. It is up to the data controller to define and determine the Data retention period for the personal data he processes, depending on the Purpose the processing.

Turn the GDPR
into a business asset Request a demo

What are the tools for defining the duration of Data retention ?

With a mission to support professionals in their GDPR compliance, the CNIL (National Commission for Information Technology and Civil Liberties) has set up tools to make it easier to define the applicable Data retention period for personal data. In addition, the personal data regulator has produced a guide to facilitate implementation of the principle of respecting Data retention periods.

This guide is designed to answer all the questions that professionals may have, both in relation to the principle of limiting the duration of personal data processing, and in relation to its practical application. It also contains a " Data retention retention time frame of reference" in terms of content and use.

The main aim of this type of Data retention duration repository is to make it easier for a data controller to find the relevant duration.

For each processing operation in a given sector, these guidelines present, in table form, the data life cycle to be followed (active base or intermediate archiving). The durations mentioned may therefore be either mandatory or recommended. In the first case, the durations are imposed by regulation, in the form of a legislative or regulatory text. If, on the other hand, they are recommended, the durations constitute a benchmark for data controllers.

Human Resources

Processing activities	Treatment details	Operating times	Prescription period	Legal references
Absences	NA	During the term of the employment or assignment contract	5 years from employee's departure	CNIL (National Commission for Information Technology and Civil Liberties) simplified standard n°42
Accidents at work	NA	While the accident is being managed	5 years from employee's departure	Article D4711-3 of the Labor Code
Directory	NA	Duration of contract of employment or service contract for personnel on secondment	NA	CNIL (National Commission for Information Technology and Civil Liberties) simplified standard n°46
Social security charges	URSSAF, pension, provident fund, etc.	While processing payroll taxes	3 years from the end of the calendar year in respect of which the charges are due	Article L244-3 of the Social Security Code
GDPR requests	NA	While the request is being processed	5 years from response to request	Article 2224 of the French Civil Code
Fees	Transport, travel, etc.	While fees are being processed	5 years	Article 2224 of the French Civil Code

Marketing and sales prospecting

Processing activities	Treatment details	Operating times	Prescription period	Legal references
Chatbots	NA	3 years from last contact	NA	CNIL (National Commission for Information Technology and Civil Liberties) simplified standard no. 48
Contract concluded electronically	For contracts over 120 euros only	For the entire duration of the business relationship	10 years	Article L213-1 of the French Consumer Code and article D213-2 of the French Consumer Code
Paper contract	NA	For the entire duration of the business relationship	5 years	Article L110-4 of the French Commercial Code
Cookies	Audience measurement	13 months maximum from the installation of cookies on the terminal	NA	CNIL (National Commission for Information Technology and Civil Liberties) deliberation no. 2020-092 of September 17, 2020.
CRM	clients data sheets	For the duration of the business relationship	5 years	Article L110-4 of the French Commercial Code
Bank card cryptogram (CVV2)	NA	Prohibition of Data retention	NA	Article 5 of the GDPR and deliberation no. 03- 034 of June 19, 2003 of the CNIL (National Commission for Information Technology and Civil Liberties)

Accounting and billing

Processing activities	Treatment details	Operating times	Prescription period	Legal references
Business correspondence	Purchase orders, delivery notes, etc.	During the entire processing period	10 years from the end of the financial year	Article L123-22 of the French Commercial Code and CNIL (National Commission for Information Technology and Civil Liberties) simplified standard no. 48.
clients billing	Invoices, estimates, etc.	During the entire processing period	10 years from the end of the financial year	Article L123-22 of the French Commercial Code and CNIL (National Commission for Information Technology and Civil Liberties) simplified standard no. 48.
Accounting books and records	NA	For the duration of the accounting process	10 years from the closing of the book or register	Article L123-22 of the French Commercial Code

Corporate life

Processing activities	Treatment details	Operating times	Prescription period	Legal references
Notices of meeting, attendance sheets and proxies	NA	3 years	NA	"Article L235-9 of the French Commercial Code
Securities orders and registers	NA	5 years	NA	Article 2224 of the French Civil Code
Minutes	NA	5 years from the last recorded minute	NA	Article 2224 of the French Civil Code
Management Report	NA	3 years	NA	"Article L235-9 of the French Commercial Code
Statutory auditors' report	NA	3 years	NA	"Article L235-9 of the French Commercial Code
By-laws	NA	5 years from deregistration	NA	Article 2224 of the French Civil Code

Security and general services

Processing activities	Treatment details	Operating times	Prescription period	Legal references
Access to premises	NA	Period of access to premises	3 months from access	CNIL (National Commission for Information Technology and Civil Liberties) simplified standard n°42
Phone calls	NA	6 months for call history	NA	https://www.cnil.fr/sites/default/files/atoms/files/travail-vie_privee.pdf
Internet connection data	e.g IP address, logs, etc.).	1 year	NA	Decree n°2011-219 of February 25, 2011r
Electronic messaging	NA	6 months for connection history	NA	https://www.cnil.fr/sites/default/files/atoms/files/travail-vie_privee.pdf
Telephone records	NA	1 year	NA	L34-2 of the French Post and Electronic Communications Code
Internet use	NA	6 months for connection history	NA	https://www.cnil.fr/sites/default/files/atoms/files/travail-vie_privee.pdf
Video protection	NA	During recording and playback	1 month from registration	Law 95-73 of 21-01-1995