Our
experience

Inventory of the processing and a comprehensive assessment of the data retention periods

Pursuant to Article 5 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (General Data Protection Regulation) (GDPR), it is the controller’s obligation to retain personal data only for as long as they are necessary for the purposes of the processing.

The controller should therefore determine the appropriate retention periods for the processed personal data on its own, based on the existing legislation. In order to perform the analysis correctly, knowledge of the processing processes as well as an individual approach to the specific data being processed is necessary, which results in very different retention periods.

For our client, a lending institution, we carried out a comprehensive inventory of the processing processes and an assessment of the data retention periods, and finally matched them to:

• the actual data processed, in the process of both lending and debt collection;
• the applicable legislation and the practice of the supervisory authority;
• the Office for the Protection of Personal Data (UODO).

It is important to remember that once adopted, the data retention policy should be reviewed periodically. This is because once established retention periods may change, whether due to amendments to the law or due to changes in business processes.