Retention periods for personal data

RGPD Fundamentals / Theory

TABLE OF CONTENTS

What is it all about ?
Human Resources
Marketing and Business Development
Accounting and billing
Corporate life
Sécurité et Services Généraux

Retention periods for personal data

Combien de temps puis-je conserver les données des clients/prospects qui ont résilié ?
Combien de temps pour des données personnelles d’un employé, notamment après son départ ?

Retention period for personal data :
What is it all about?

Personal data can only be stored for a limited period, which is set either by law (e.g. laws, decrees, regulations) or directly by the French supervisory authority, the CNIL, via recommendations, simplified standards, etc.

This is undoubtedly the most perilous and complex project to implement, since it involves raising awareness and providing in-house training for the departments concerned.

Fortunately, more and more “business software”, particularly in the human resources sector, is finally beginning to offer tools that enable the retention period for personal data to be respected automatically.

Nevertheless, not only is this not always the case, but many doubts may remain on a day-to-day operational basis about the applicable personal data retention period.

In this page you will be able to consult the personal data retention periods that apply in the areas of Human Resources, Business Development and Marketing, Accounting and Social Documents.

All the latest CNIL reforms and positions from January 1, 2020 have been taken into account.

Identify the retention period for personal data

To define the retention period for the personal data you process, it is necessary to carry out a compliance analysis of your processing operations. It should be noted, however, that some regulations stipulate a retention period for personal data. In other words, in certain cases, the retention period for personal data is laid down in specific articles. For example, article L3243-4 of the French Labor Code requires that an employee’s payslip (considered personal data in this case) be kept for 5 years.

On the other hand, for the majority of personal data processing operations, the retention period is not imposed by any regulation or text. It is up to the data controller to define and determine the retention period for the personal data he or she processes, depending on the purpose of the processing.

What tools are available to define the retention period for personal data?

With a mission to support professionals in their RGPD compliance, the CNIL has set up tools to facilitate the definition of the applicable personal data retention period. In addition, the personal data regulator has provided a guide to facilitate the implementation of this principle, which is compliance with retention periods.

This guide is designed to answer any questions that professionals may have, both in relation to the principle of limiting the duration of personal data processing, and in relation to its practical implementation. It also contains a “retention period reference” in terms of content and use.

The main aim of this type of data retention period repository is to make it easier for data controllers to find the relevant period.

For each processing operation in a given sector, these repositories present, in tabular form, the data life cycle to be followed (active base or intermediate archiving). The durations mentioned may therefore be either mandatory or recommended. In the first case, the durations are imposed by regulation, in the form of a legislative or regulatory text. If, on the other hand, they are recommended, the durations constitute a benchmark for data controllers.

Human Resources

Processing activities	Treatment details	Operating times	Prescription period	Legal references
Absences	NA	During the term of the employment or assignment contract	5 years from employee's departure	CNIL simplified standard n°42
Accidents at work	NA	While the accident is being managed	5 years from employee's departure	Article D4711-3 of the Labor Code
Directory	NA	Durée du contrat de travail ou de prestation de service du personnel mis à disposition	NA	CNIL simplified standard n°46
Social security charges	URSSAF, pension, provident fund, etc.	While processing payroll taxes	3 years from the end of the calendar year in respect of which the charges are due	Article L244-3 of the Social Security Code

Marketing and Business Development

Processing activities	Treatment details	Operating times	Prescription period	Legal references
Chatbots	NA	3 years from last contact	NA	CNIL simplified standard n°48
Contract concluded electronically	For contracts over 120 euros only	For the entire duration of the business relationship	10 years	Article L213-1 of the French Consumer Code and article D213-2 of the French Consumer Code
Paper contract	NA	For the entire duration of the business relationship	5 years	Article L110-4 of the French Commercial Code

Accounting and billing

Processing activities	Treatment details	Operating times	Prescription period	Legal references
Business correspondence	Purchase orders, delivery notes, etc.	During the entire processing period	10 years from the end of the financial year	Article L123-22 of the French Commercial Code and CNIL simplified standard no. 48
Customer billing	Invoices, estimates, etc.	During the entire processing period	10 years from the end of the financial year	Article L123-22 of the French Commercial Code and CNIL simplified standard no. 48
Accounting books and records	NA	For the duration of the accounting process	10 years from the closing of the book or register	Article L123-22 of the French Commercial Code

Corporate life

Processing activities	Treatment details	Operating times	Prescription period	Legal references
Notices of meeting, attendance sheets and proxies	NA	3 years	NA	"Article L235-9 of the French Commercial Code".
Securities orders and registers	NA	5 years	NA	Article 2224 of the French Civil Code
Verbatim reports	NA	5 years from the last recorded minute	NA	Article 2224 of the French Civil Code

Sécurité et Services Généraux

Processing activities	Treatment details	Operating times	Prescription period	Legal references
Access to premises	NA	Period of access to premises	3 months from access	CNIL simplified standard n°42
Phone calls	NA	6 months for call history	NA	https://www.cnil.fr/ sites/default/ files/atoms/files/travail-vie_privee.pdf
Internet connection data	(e.g. IP address, logs, etc.)	1 year	NA	Decree n°2011-219 of February 25, 2011r

Se connecter

RGPD Fundamentals / Theory