What is the GDPR data retention period? The GDPR’s text sets no fixed number. Article 5(1)(e) says personal data must be kept in a form which permits identification for no longer than is necessary for the purposes it is processed for, and the UK’s ICO says the UK GDPR “does not set specific time limits for different types of data.” For a prospect who is not a customer, France’s CNIL, in a 2021 reference framework that is not binding, says the data may be kept for three years from its collection or from the prospect’s last contact, and that opening an email should not be considered contact (my translation).
In my view, the bigger risk in outbound is not deleting too early. It is keeping every lead you ever imported with no end date at all.
In my view, keeping a lead ‘just in case’, as the ICO puts it, is not a retention period.
Key numbers
| Item | Number |
|---|---|
| Fixed retention period in the GDPR text (Article 5(1)(e): no longer than necessary in identifiable form) | None |
| CNIL framework: prospect who is not a customer (from collection by the controller or the prospect’s last contact; not binding) | 3 years |
| CNIL framework: customer data used for prospecting (kept during the relationship, then 3 years from its end; not binding) | 3 years after it ends |
| CNIL reference framework adopted (deliberation 2021-131, published in the Journal officiel on 10 April 2022) | 23 September 2021 |
| KASPR retention the CNIL faulted (for people who change jobs or employers before 5 years) | 5 years from each update |
| CNIL fine on KASPR, decided 5 December 2024 (for several breaches, including retention) | 240,000 euros |
| Contacts in KASPR’s database in December 2024 (per the CNIL’s release of 19 December 2024) | About 160 million |
| CNIL closed the KASPR order (database deleted and renewal mechanism removed) | 4 March 2026 |
Read on 12 November 2026 from the EU GDPR on EUR-Lex, the ICO’s storage limitation and direct marketing guidance, the CNIL’s 2021 reference framework on Légifrance, and the CNIL’s KASPR releases of 19 December 2024 and 6 March 2026.
What the GDPR says about how long you can keep data
Article 5(1)(e) of the EU GDPR requires data to be “kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed”. Recital 39 adds that “time limits should be established by the controller for erasure or for a periodic review.” So the controller sets the period. Article 13(2)(a), for data collected from the person, and Article 14(2)(a), for data not obtained from them, both require telling people “the period for which the personal data will be stored, or if that is not possible, the criteria used to determine that period”. This is general information, not legal advice.
| Source | Period it gives for prospect data | Status |
|---|---|---|
| EU GDPR, Article 5(1)(e) | No fixed number: no longer than necessary in identifiable form | Law |
| ICO storage limitation guidance | No fixed number: the UK GDPR “does not set specific time limits” | UK guidance, under review after the Data (Use and Access) Act |
| CNIL reference framework, prospect who is not a customer | 3 years from collection by the controller or the prospect’s last contact | French guidance, not binding |
| CNIL reference framework, customer data used for prospecting | During the relationship, then 3 years from its end | French guidance, not binding |
The CNIL’s three years, and what restarts the clock
The CNIL’s reference framework for commercial management (deliberation 2021-131 of 23 September 2021, published in the Journal officiel on 10 April 2022) says, in my translation, that data about “a prospect who is not a customer may be kept for three years from their collection by the controller or from the last contact from the prospect”. Its examples of contact are a request for documentation or a click on a link in an email leading to the promoted product, while “simply opening an email should not be considered contact from the prospect.” At three years, you may ask the person whether they still want commercial messages; without a positive and explicit answer, the framework says to delete the data or archive it for a period in line with the rules in force. It calls itself non-binding: you may keep data longer if you make sure the period does not exceed what the purpose needs. This is general information, not legal advice.
My view: if your sequencer scores an open as engagement, do not let that field restart your retention clock. On my reading, a reply is contact from the prospect too. Hypothetically, a lead collected on 1 March 2026 who never replies or clicks reaches three years on 1 March 2029; a click on 10 June 2027 moves that to 10 June 2030, and an open changes nothing.
KASPR: the five-year reset the CNIL faulted
The CNIL said KASPR markets a paid Chrome extension that lets customers obtain the professional contact details of people whose LinkedIn profiles they visit, from a database of about 160 million contacts. On 5 December 2024 it fined KASPR 240,000 euros for breaches of the legal basis, retention, transparency and access rules; the CNIL’s English release of 19 December 2024 leads with the collection of LinkedIn contact details “even if they previously masked them”. On retention, it says that for lawfully collected contacts KASPR kept details “for 5 years from each data update, which generally occurs when a person changes job or employer”, and that for people who change jobs or employers before 5 years, “this renewal of the retention period leads to their data being kept for a disproportionately long time.” It ordered KASPR to stop the automatic renewal. The CNIL closed the order on 4 March 2026: KASPR had deleted its database, stopped collecting on LinkedIn and removed the renewal mechanism. This is general information, not legal advice.
Restart the clock whenever a data tool refreshes the record, so a lead never ages out (illustrative).
The CNIL faulted KASPR’s five years, renewed at each data update, for people who change jobs or employers before five years.
My suggestion: a written period from collection, restarted only by the prospect’s own contact, with a review before it ends.
The CNIL’s framework: three years from collection or the last contact from the prospect; an email open should not be considered contact (my translation).
The UK position: no number, but a policy and a review
The ICO says in its storage limitation guidance that “The UK GDPR does not set specific time limits for different types of data” and that you “should not keep data indefinitely ‘just in case’”. It expects a policy setting standard retention periods wherever possible and a periodic review; a small organisation doing occasional low-risk processing may not need a documented policy, but must still regularly review its data. The ICO says that guidance is under review due to the Data (Use and Access) Act. Its direct marketing guidance says “Data protection law doesn’t have specific timescales” for keeping information for direct marketing, that you should keep a record of your retention periods, and that you “must tell people how long you will keep their information”. This is general information, not legal advice.
Four steps to set a retention period for prospects
Write one period per purpose
The CNIL’s framework says a period must be set for each purpose (my translation), and the ICO expects a policy wherever possible. My suggestion: one line for prospects who never replied, one for customers and one for opt-outs, each with the date its clock starts.
Restart the clock only on their action
In the CNIL’s non-binding framework, a click or a documentation request are examples of contact, and an open should not be considered contact. In my view, a data refresh should not restart it either: a renewing period is what the CNIL faulted in KASPR.
Put the period in your notice
Article 14(2)(a) requires the period, or the criteria used to determine it, when the data was not obtained from the person. See also our legitimate interest assessment guide.
Stop marketing, keep the opt-out
Under Article 21(3), once a person objects to direct marketing, their data “shall no longer be processed for such purposes.” In the UK, the ICO’s direct marketing guidance says you must delete or anonymise data you no longer need for direct marketing, unless you need to keep a small amount for another purpose, such as a suppression list.
My team’s record: 500+ projects delivered across 30 countries. Our email infrastructure page covers one-click unsubscribe, suppression and list validation; the retention period you set is for you and your lawyer to decide. If a prospect asks what you hold, see our guide to DSAR response time; for sending, see email hosting cost and what an email deliverability consultant costs.
The bottom line
No fixed GDPR period; a non-binding CNIL guide proposes 3 years for prospects from collection or last contact. In my view, what holds up is a written period per purpose, a clock only the prospect’s own contact restarts, and a suppression list that outlives the lead. This is general information, not legal advice.