How do you set a retention period when the law does not specify one?

The period is not picked from a list. First write down what the data is needed for: to perform a contract, to calculate pay, to defend against a claim, to prove consent. Once the purpose is achieved, the basis for keeping the data disappears, unless another independent purpose arises.

A common mistake is keeping data "just in case". That is not a purpose, it is the absence of one. If you cannot explain in one sentence what the data is still needed for, the period has already ended.

On top of the purpose period, add the time during which a dispute could realistically still arise: a complaint about a service, a claim, an inspection. This period is usually derived from the limitation periods applicable to the relevant relationship; for the exact limitation rules, see Article 1.125 of the Civil Code.

It is important not to turn this period into a universal answer. Keeping the organisation's whole database for the full limitation period is not a justification — the justification is an explanation of why this particular group of data may specifically be needed to defend against or bring a claim.

If several factors determine the retention period, write them all down: a statute for one part of the documents, dispute risk for another. A transparent rationale holds up better than a round number with no explanation.

Retention periods are reviewed together with the record. If you find that certain data is not actually used after a year, it is worth shortening the period — this reduces both the risk and the workload in the event of a breach.

When reviewing, it helps to check three things: whether the data is actually deleted once the period ends, whether deletion covers copies and paper records, and whether the period still matches the real process. If the process has changed, the period usually needs to change too.

Website customer inquiries: the purpose is met once you reply, so the retention period is short — just long enough to answer and assess whether the inquiry will turn into a contract. If it does, the data moves into the contract process with its own retention period.

Video footage: the purpose is security, and incidents are noticed quickly, so the usual retention period is fourteen days. Only a specific recording needed for an investigation is kept longer, and this is recorded.

Marketing consents: the proof of consent itself is kept longer than the list, because it may be needed to demonstrate lawfulness after someone opts out. This is a good example of two different retention periods coexisting within a single process.