Retention: as long as the purpose requires, not just in case

The principles of the FADP, in particular proportionality, prohibit keeping personal data longer than the purpose of the processing requires. A statutory duty to retain records, for example accounting documents for the period set by commercial and tax law, prevails over deleting too soon. When that duty ends and the purpose is achieved, the data are deleted or anonymised so that the person can no longer be identified. There is no single period for every category. The business writes the periods down and applies them, including at the processor.