You are looking at a potential Tier 2 GDPR fine: up to €20 million or 4% of annual global turnover, whichever is greater.
Nobody broke in. No system was compromised. The data simply sat in a system — retained long past any legitimate purpose, used in a way the original collection never covered.
Two principles were violated:
- Data minimization under GDPR Article 5(1)(c)
- Storage limitation under GDPR Article 5(1)(e)
Not through malice, but through the absence of enforced operational controls.
This is no longer an hypothetical; it's the scenario regulators are now investigating at scale.
GDPR cumulative fines have exceeded €7.1 billion — more than 60% of that total landing since January 2023. France's CNIL fined Free Mobile €27 million in early 2026 for retention failures alone. Poland fined a major bank for collecting data that went beyond what its stated purposes required. In the United States, California and Connecticut jointly collected $5.1 million from an ed-tech business for failing to limit data collection and implement deletion controls. Learn more about the full quarterly breakdown of GDPR fines by DPA.
The pattern is consistent: enforcement follows wherever minimization and retention obligations exist in law but not in systems.
Three things to understand before going further:
- GDPR Article 5(1)(c) requires personal data to be adequate, relevant, and limited to what is necessary. Article 5(1)(e) requires it to be kept no longer than necessary. Both are actively enforced.
- US state privacy laws — Maryland, Colorado, Connecticut, California, and others — have introduced their own data minimization requirements, creating compliance complexity for organizations with national footprints.
- The core operational failure is almost always the same: policies that exist on paper but are never technically implemented in data pipelines or retention schedules.
What Data Minimization and Retention Enforcement Actually Require
A cookie banner captures consent. A retention policy declares an intention. Neither does anything unless something enforces it.
Data minimization and storage limitation address distinct problems in sequence.
Data minimization governs what you collect. Under GDPR Article 5(1)(c), personal data must be adequate — sufficient to fulfil the stated purpose — relevant, directly connected to that purpose, and limited to what is necessary. An e-commerce business collecting shipping addresses for delivery does not require customers' marital status, income range, or browsing history across unrelated sites. Collecting it anyway, even if users don't notice, is a violation. Data minimization principles under EU, US and global privacy laws maps how this standard applies across every major framework.
Storage limitation governs how long you keep it. Under GDPR Article 5(1)(e), personal data must not be kept in identifiable form longer than necessary for the purposes for which it was processed. This requires specific retention periods for each data category, tied to the processing purpose, with deletion or anonymization when that period expires.
Vague commitments — "we keep data for as long as necessary" — do not satisfy Article 5(1)(e). They provide no justifiable period against which compliance can be assessed or audited. The Irish DPC has made this explicit: retention periods must be specific and self-explanatory. Learn more about which DPAs are prioritizing retention violations this quarter.
Together, these principles create a lifecycle discipline:
- Collect only what you need, for the purpose you have stated
- Delete it when that purpose is fulfilled
- Prove it
The accountability principle under Article 5(2) adds the final requirement: you must be able to demonstrate compliance with both, not merely declare it. Tracing data across its entire lifecycle — collection, storage, usage, transfer, deletion — is the operational foundation that makes this demonstrable.
The Regulatory Picture: EU and US Requirements Side by Side
"We're not subject to GDPR" is the wrong question.
63% of comprehensive state privacy laws enacted in 2025 now mandate data minimization in terms that mirror GDPR's Article 5(1)(c) language. If you have US users, you almost certainly have minimization obligations — the question is which framework governs each processing activity.
Under GDPR, storage limitation and data minimization apply regardless of the legal basis for processing. Even where consent is the basis, data cannot be retained indefinitely — retention is tied to purpose, and when the purpose ends, so does the justification for keeping the data. Every retention decision must be documented in the Record of Processing Activities (RoPA) with a specific period and stated justification.
Under US state law, the picture is more fragmented:
- Maryland's Online Data Privacy Act — enforcement began April 2026 — requires businesses to collect only data "reasonably necessary" to provide the specific product or service requested, and prohibits processing sensitive data beyond what is strictly required
- Colorado's Privacy Act requires data to be adequate, relevant, and reasonably necessary for the declared purpose
- Connecticut, Virginia, Indiana, Kentucky, and Rhode Island all include data minimization obligations, with enforcement priorities in 2026 specifically targeting whether businesses have operationalized these requirements
- California's CCPA requires privacy notices to disclose retention periods or the criteria used to determine them
The divergence matters operationally. GDPR's standard is purpose-specific and applies to all processing activities regardless of scale. Most US state laws apply only to businesses meeting applicability thresholds — typically 100,000 consumers processed annually, or 25,000 with data sale revenue exceeding 50% of gross revenue. The US state privacy law tracker for 2026 covers the current enforcement status and applicability thresholds for each active state law.
For organizations operating across both jurisdictions, building to GDPR's stricter documentation standard is the most defensible position.
Retention Schedules: Building Justifiable Periods by Data Category
Most organizations have a privacy notice that references data retention in general terms. Most have a RoPA that lists data categories without periods. Neither satisfies regulators' expectations.
A retention schedule must address two layers simultaneously: legal minimums that create a floor, and privacy-driven maximums that create a ceiling.
The floor: legal minimums from outside privacy law. Employment law typically requires HR records — contracts, performance reviews, disciplinary documentation — to be retained for defined periods after employment ends, often five to seven years. Tax and financial regulations require transaction records for defined periods. Healthcare records are governed by sector-specific rules. The retention schedule must respect these minimums.
The ceiling: privacy-driven maximum periods tied to processing purpose:
- Customer account data — retain for the duration of the account relationship plus a defined post-closure period, typically one to three years, to handle disputes or legal claims
- Marketing list data — retain only while the contact remains active or through a documented re-engagement cycle; unresponsive contacts should be deleted
- Behavioral analytics and profiling data — typically 12 months, with documented review before any extension
- Employee records subject to legal minimums — archive with restricted access after active employment ends, then delete at the legal maximum
The justification for each period must be documented. "Two years post-closure" is the starting point. Documenting why two years is the minimum necessary — referencing the limitation period for relevant claims, the regulatory context, and the business rationale — is what makes the schedule defensible when regulators ask. The comprehensive guide to data minimization and retention policies covers how to structure these justifications across data categories and jurisdictions.
The Five Implementation Steps
Organizations that treat minimization and retention as iterative operational processes — not one-time compliance projects — are the ones that remain defensible under scrutiny.
Step 1: Build a comprehensive data inventory. You cannot enforce minimization or retention on data you cannot see. The inventory maps every personal data category across every system, database, SaaS integration, and third-party processor — recording what is collected, the stated processing purpose, who has access, where it is stored, and how it flows between systems. Manual inventories become stale within weeks in environments where engineering teams regularly deploy new services. Automated discovery tools that continuously scan infrastructure are not a luxury — they are the only way to keep the inventory current.
Step 2: Map retention requirements per data category per jurisdiction. The inventory output feeds a retention schedule that assigns specific periods to each category, documents the legal justification, and flags any jurisdiction-specific variations. For organizations processing under both GDPR and US state laws, the schedule should record which framework governs each processing activity and note where requirements conflict or stack. RoPA automation covers how to keep these records current without manual overhead as your processing activities evolve.
Step 3: Assign named owners. Every data category in the retention schedule needs a named owner — typically the business unit that generates or uses the data — with defined responsibility for updating the schedule when processing activities change and for confirming that automated deletion has executed correctly. Without named owners, retention schedules become static documents that diverge from operational reality.
Step 4: Implement automated deletion and archival workflows. This is where most compliance programs fail. The retention policy exists in a document. No technical mechanism enforces it. Automated retention enforcement connects the retention schedule to the actual systems holding the data — CRM platforms, HR systems, email databases, analytics platforms, and third-party processors. Deletion must be confirmed, logged, and retained as an audit trail. The record that deletion occurred is itself a compliance artifact.
Step 5: Run continuous monitoring and audit readiness. Retention compliance does not reach a completion state. Processing activities change. New data categories are introduced. Regulations are updated. Regular audits — at minimum annually, with automated monitoring running continuously — verify that the retention schedule reflects current reality, that automated deletion is executing correctly, and that deviations are investigated, remediated, and documented. Privacy engineering best practices covers how to build the technical infrastructure that makes continuous enforcement possible rather than aspirational.
Real-World Failure Patterns and What They Cost
The violations below share one structural cause: minimization and retention obligations were stated in policy. They were not operationalized in systems.
France — Free Mobile, €27 million (2026). The CNIL enforcement action centered specifically on retention violations — data retained beyond its legitimate period, inadequately protected during retention, and not properly managed when a breach occurred. The fine was not for the breach. It was for what the organization was doing with the data before the breach.
Poland — major bank, undisclosed fine (2025). Enforcement under Articles 5(1)(c) and 6(1) — data minimization and lawfulness. Regulators found the bank collecting and processing data that went beyond what its processing purposes actually required. No breach. No bad actor. The minimization principle simply had not been operationalized in the data collection architecture.
United States — ed-tech business, $5.1 million (2025). California and Connecticut jointly enforced against the failure to limit data collection and implement deletion controls — specifically for failing to employ reasonable measures to protect personal information and restrict its collection. Maryland's enforcement priorities for 2026 specifically name data minimization as a focus, with $2 million allocated to privacy enforcement. For context on how Maryland's requirements differ from other state laws, see the Maryland Online Data Privacy Act compliance guide.
You are not paranoid for taking these seriously. You are operating in an enforcement environment that has moved from guidance to penalties — and is still accelerating.
Common Mistakes That Generate Exposure
Collecting unnecessary personal data. Every field collected without a clear processing purpose creates compounding retention liability — data that should not exist must still be managed, deleted, and accounted for in DSARs. The instinct to collect broadly "in case it's useful" is directly in conflict with both GDPR's necessity standard and US state minimization requirements. Reviewing form fields, tracking pixels, analytics configurations, and API data pulls against declared processing purposes is a minimization audit most organizations have not conducted rigorously.
Failing to document retention decisions. When a supervisory authority requests documentation of retention justifications, "we have always kept this data for five years" is not a defensible answer. The documented rationale — referencing the applicable legal basis, the business purpose, the minimum necessary period, and the legal minimum where applicable — must exist before the question is asked. Data protection standard operating procedures covers how to build and maintain the documentation workflows that make this demonstrable under audit.
Ignoring vendor data retention. Every processor handling personal data on your behalf is governed by a Data Processing Agreement that must specify how data is handled, retained, and deleted. Processors retaining personal data longer than your retention schedule allows are in violation of that agreement and of the underlying regulatory requirements. Auditing processor retention practices — not just contractually, but through questionnaires or direct audits — is increasingly expected. California's Tractor Supply enforcement centered specifically on the absence of adequate service provider agreements.
Consent Alignment and Deletion as Connected Workflows
Most organizations track consent state in a consent management platform. Most track data retention in a separate CRM or HR system. The two systems do not communicate.
This is a structural compliance gap.
Under GDPR Article 7(3), consent withdrawal must be as easy as consent was to give — and the effect of withdrawal is that processing relying on that consent must stop. For data retained under consent as the legal basis, withdrawal triggers a deletion obligation.
In practice: a user withdrawing consent from a marketing preference center does not automatically trigger deletion of behavioral data held in the analytics warehouse. These systems need to communicate. Consent withdrawal events should propagate to every system holding consent-dependent data and trigger retention review workflows.
Handling GDPR right to erasure requests requires the same foundation: a functioning data inventory, documented deletion processes, and confirmed execution across all relevant systems. The erasure request is not the hard part. Proving you actually deleted the data — across every system that held it — is.
FAQ
What is data minimization under GDPR?
It is the principle in GDPR Article 5(1)(c) requiring that personal data be adequate, relevant, and limited to what is necessary for the stated processing purpose. Organizations should collect only the data they genuinely need for the specific purpose for which they are collecting it — not data that might be useful, not data collected by default.
How long can I retain customer data?
There is no single answer. Retention periods must be determined per data category and per processing purpose, tied to the minimum period necessary while meeting any applicable legal minimums. Customer account data might be retained for one to three years post-closure. Transaction records may need to be kept for six or seven years for tax purposes. Marketing data should be reviewed and deleted after a defined engagement period.
How do I justify data collection under GDPR?
By documenting the processing purpose, the legal basis, and the necessity of each data category collected, in the Record of Processing Activities. The justification must demonstrate that each field is adequate, relevant, and necessary — not merely useful or potentially valuable in future.
Which US states have data minimization obligations?
Maryland, Colorado, Connecticut, California under CCPA/CPRA, Virginia, Indiana, Kentucky, Rhode Island, and others. The framing varies — GDPR uses "adequate, relevant, and limited to what is necessary"; US state laws typically require collection of data "reasonably necessary" for the stated purpose — but the operational obligation is substantively similar. The full breakdown of US consumer data privacy laws covers applicability thresholds and requirements for each active state framework.
How can I automate deletion workflows?
Through data discovery tools that continuously scan for data exceeding retention periods, integrated with deletion pipelines that execute purges across all relevant systems and generate audit logs confirming deletion. Consent management platforms should propagate withdrawal events to downstream data systems. Privacy governance platforms can orchestrate these workflows and provide the compliance evidence that audits require.
The organizations that survive regulatory scrutiny are not the ones with the best-written privacy notices.
They are the ones where the retention schedule matches what the systems actually do — and where deletion is a confirmed event with an audit trail, not a stated intention.
Stop managing minimization and retention in documents that diverge from your systems. See how Secure Privacy's data governance platform automates retention enforcement, DSAR fulfillment, and compliance workflows across GDPR and US state privacy requirements.
