Data retention periods: how long may you keep customer data?

Under Dutch law you may keep customer data only as long as you need it for the purpose you collected it for, unless a statute obliges you to keep it longer. The main exception is your financial administration: Article 52 of the General Taxes Act (Algemene wet inzake rijksbelastingen, AWR) and Article 2:10 of the Dutch Civil Code (BW) require you to keep it for seven years, including the customer data in it.

This page explains how the GDPR (in Dutch: AVG) and Dutch statutory retention duties fit together, which periods apply to the most common types of data, and what you must do when a period ends. For the wider framework, see our overview of Dutch data privacy laws.

What is the main rule for keeping customer data?

The GDPR sets no fixed number of years. It says you may not keep personal data in identifiable form longer than necessary for the purpose for which you process it (the storage-limitation principle).

In practice this means three things. You keep data only for the specific purpose you collected it for, such as delivering an order or sending a newsletter. You keep only the data you actually need. And you record each retention period and the reason for it, because the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, AP) can ask you to justify it.

When the purpose ends, so does your legal basis for keeping the data. You then delete it or anonymise it so that it can no longer be traced back to a person. Keeping data “just in case” is not a purpose.

Where do the fixed retention periods come from?

Fixed periods come from specific Dutch statutes, not from the GDPR. The Dutch GDPR Implementation Act (Uitvoeringswet AVG, UAVG) does not create retention periods either.

The GDPR tells you the maximum (no longer than necessary); a specific statute tells you the minimum (how long you must keep certain records). A retention schedule that cites only one of the two is incomplete. Where a statute requires you to keep data, that legal obligation is your basis for keeping it, but only for the data the statute covers and only for that period.

How long must you keep financial and tax records?

Seven years. Article 52(4) AWR obliges every business to keep its books, records and other data carriers for seven years, and Article 2:10(3) BW imposes the same seven-year duty on the board of a legal entity.

The duty covers invoices, purchase and sales records, ledgers, bank statements, cash-register and point-of-sale data and the annual accounts. Customer names and addresses on invoices fall within it. Records may be transferred to another data carrier, such as a scan, as long as they remain complete and readable throughout the period (Article 52(5) AWR and Article 2:10(4) BW).

Records relating to real estate have a longer period. Under Article 34a of the Turnover Tax Act 1968 (Wet op de omzetbelasting 1968) a business must keep them for nine years following the year in which it started using the property, so in effect ten years.

The tax duty does not justify keeping everything for seven years. Your marketing profile of a customer, for example, is not part of the administration and needs its own, shorter period.

How long may you keep employee and applicant data?

Payroll records are part of the administration and fall under the seven-year rule of Article 52 AWR. The wage tax statement (loonbelastingverklaring) and the copy of the employee’s identity document are covered by separate wage tax rules; check the current term with the Belastingdienst before you set it in your schedule.

The rest of the personnel file has no statutory period. The AP’s guidance applies the necessity principle: most of the file may be kept only for a limited period after the employment ends, and longer only where there is a concrete reason, such as a pending dispute. Data on sick leave may only be processed within the narrow limits the AP sets for employers; see our page on employee sickness rights.

Data of job applicants is treated more strictly. If a candidate is rejected, the AP expects you to delete the data within weeks after the procedure ends, unless the candidate consents to a longer period. Folding applicant data into the personnel-file period is a common and avoidable mistake.

How long are medical files kept?

Twenty years. Under Article 7:454(3) BW a healthcare provider keeps the medical file for twenty years from the last change to the file, or longer where good care reasonably requires it.

This duty applies to healthcare providers under the medical treatment contract (WGBO). An ordinary business that receives health data, such as an employer, may not rely on it. Health data is a special category of personal data and may only be processed on the narrow grounds the GDPR and the UAVG allow.

How long should you keep contracts and correspondence?

There is no statutory period, so the limitation period for claims drives the decision. A claim for performance of a contract becomes time-barred five years after it became due (Article 3:307 BW). A claim for damages becomes time-barred five years after the injured party knew of the damage and the liable person, and in any case twenty years after the event (Article 3:310 BW).

Keeping a contract for its term plus five years is therefore a defensible schedule that you can explain to the AP. A flat period chosen for convenience is not. If a dispute arises, you may keep the relevant data until it is finally resolved (see below).

How do you set up a retention schedule?

List every category of personal data, its purpose, its legal basis and its period, and record where the data is stored. Back-ups and archives count too.

A simple schedule could look like this. The first and last rows follow from statute; the middle rows are examples of periods you set yourself and must be able to justify.

Your privacy statement must tell customers how long you keep their data, or the criteria you use to set the period. “As long as necessary” on its own is too vague. Sector codes of conduct can help you choose reasonable periods, but you remain responsible for the choice.

What happens when a retention period ends?

You delete the data or anonymise it, and you document that you did so. Moving files to a recycle bin or hiding a database record is not deletion.

• Use secure deletion software or destroy the storage media for digital data.
• Shred paper records; never put them in ordinary waste.
• Use a certified destruction service for large volumes and keep its certificate.
• Build automatic deletion into your systems and check it at least once a year.

An exception applies where data is needed for a pending dispute, investigation or complaint. You then suspend deletion for that data only (a legal hold), record why, and lift the hold when the proceedings or the complaint are concluded.

What rights does the customer have?

A customer can ask you to erase their data once you no longer need it, and can object to its processing. You must respond within one month; for complex requests that period can be extended to a maximum of three months in total, and you must tell the customer about the extension.

If statute requires you to keep the data, such as an invoice within the seven-year period, you may refuse erasure for that data, but you must explain why. Customers can also use their right of access to see what you hold. If you do not respond, they can complain to the AP.

What does the AP do if you keep data too long?

The Dutch Data Protection Authority can investigate, order you to delete data and impose an administrative fine; the GDPR allows fines up to a percentage of worldwide annual turnover. Customers can also claim damages in the civil courts.

The AP usually starts with a complaint or a data breach. Unnecessary old data makes the consequences of a breach worse, because more people are affected.

What should you check as a business?

• Is every data category in your records of processing linked to a purpose and a period?
• Do you separate the seven-year administration under Article 52 AWR from marketing and account data?
• Are rejected applicants’ data deleted within weeks, unless they consented to longer retention?
• Does your privacy statement state the actual periods or criteria?
• Do your systems, including back-ups, delete data automatically when the period ends?
• Do you have a legal-hold procedure for disputes and complaints?

What should you check as a customer?

• Does the privacy statement say how long your data is kept?
• Has the purpose ended, for example because you closed your account or unsubscribed?
• Did you receive an answer to your erasure request within one month?
• If the business refuses, does it name a statutory duty, such as the seven-year tax rule?
• If not, have you considered a complaint to the AP?

What can we do for you with data retention?

Our IT and privacy lawyers help businesses set and defend their retention periods.

• We map your data categories and draft a retention schedule with a legal basis for each period.
• We check your privacy statement against the periods you actually apply.
• We set up a legal-hold and deletion procedure for your organisation.
• We assess erasure and access requests and draft your reply within the one-month deadline.
• We represent you in an AP investigation or complaint procedure.

Summary

• The GDPR sets no fixed periods: you keep personal data no longer than necessary for its purpose.
• Your administration, including customer data on invoices, must be kept for seven years (Article 52 AWR, Article 2:10 BW); real-estate records for nine years after the year of first use.
• Medical files are kept for twenty years (Article 7:454 BW); contracts usually for their term plus the five-year limitation period.
• When a period ends, delete or anonymise the data and record it, unless a legal hold applies.
• Customers can request erasure; you must respond within one month.

Frequently asked questions