Keep each document as long as needed, and no longer.
The GDPR requires personal data to be kept only as long as necessary for its purpose. The hard part is not writing the rule: it is applying it to thousands of documents received by email, through a portal, or in a campaign.
Coming soon to Nestor: compliance labels that apply your retention periods to the documents you collect, with human validation before any deletion.
The life cycle of a collected document
- CollectionThe document arrives: the retention period starts.
- QualificationPurpose, legal basis, retention period, and justification are known.
- DeadlineAn alert warns you before the period ends.
- ActionArchiving, anonymization, or deletion, after validation.
01Chapter
Rules on paper, rarely applied.
Most organizations have a retention policy. Few can say where the documents it covers actually are.
Documents everywhere.
Mailboxes, shared drives, business tools: the same document often exists in several copies.
Periods that vary.
The period depends on the document, the purpose, the applicable text, and its starting point: end of contract, last contact, collection.
Deletion nobody gets to.
The deadline arrives without warning, and deleting hundreds of files by hand is nobody's priority.
Proof to provide.
During an inspection or when an individual makes a request, you have to show what was kept, what was deleted, and when.
02Chapter
What the GDPR requires on retention.
Personal data must not be kept in a form that allows people to be identified for longer than necessary for the purposes for which it is processed (article 5). This is the storage limitation principle, which goes hand in hand with data minimization: collect only what is useful.
People must be informed of the retention period or, if that is not possible, of the criteria used to determine it (article 13). The record of processing activities states, where possible, the planned time limits for erasing the different categories of data (article 30).
A retention period can also come from another text: accounting obligations, anti-money laundering rules, employment law. Set each period with your DPO or your legal counsel, recording its justification and its starting point.
03Chapter
Five steps from rule to practice.
- Step 01
Take inventory
List the types of documents and data you collect, and where they arrive.
- Step 02
Qualify
For each one: purpose, legal basis, retention period, starting point, and justification.
- Step 03
Attach
Link the rule to where the collection happens: the form, the file, the request template.
- Step 04
Automate the deadline
Send a warning before the period ends, then archive, anonymize, or delete, with human validation.
- Step 05
Keep the proof
Keep a log of what was done and an up-to-date record of processing activities, ready for an inspection.
04Chapter
Coming soon to Nestor: compliance labels.
Labels will apply this method where your documents arrive. They are being finalized.
- Labels that carry the ruleData category, legal basis, purpose, sensitivity, retention period, and justification.
- Automations at the deadlineAlert, archiving, anonymization, or deletion, always with human validation.
- A log and a recordThe audit log, the evidence file, and the record of processing activities.
- Already available todayEach space's activity log, exportable as CSV, and access set space by space.
05Frequently asked questions
Frequently asked questions
What retention period should I choose for my documents?
It depends on the purpose and on the texts that apply to each type of document. Start from your record of processing activities, the obligations of your industry, and the recommendations of the CNIL (the French data protection authority), and have your choices approved by your DPO.
Should I delete or anonymize?
Both mean you no longer keep personal data. Anonymization must be irreversible: data that is only pseudonymized is still personal data. Delete what you no longer need, and anonymize what still feeds your statistics.
Does Nestor already apply my retention periods?
Not yet: compliance labels are being finalized. Today, each space has its own exportable activity log, and you can close and then archive a space once the file is finished.
Do you have retention rules to apply?
Tell us about the documents you collect and the rules you must follow: we will show you Nestor and let you know when labels become available.
- Fully sovereign European hosting
- No account to create for the people you work with