Retention periods
The content of a digital or paper file contains a lot of information about a person. In order to be able to keep proper records and perform its services, Tilburg University must therefore retain certain personal data for a certain period of time. However, this data may not be kept longer than necessary.
There is no specific retention period for personal data under the GDPR. Organizations must determine for themselves how long they store personal data. In doing so, they must consider how long the data is needed for the purpose for which it was collected or used. However, there are concrete retention periods in other laws that must be observed. For example, on the basis of tax legislation.
Tilburg University has determined which retention period is used for certain personal data in its privacy policy documents on various subjects. Always check these policy documents to see whether a retention period has already been set.
Destroy or archive
When the retention period of personal data has passed or the data is no longer necessary, the data must be destroyed. Are the personal data intended for historical, statistical or scientific purposes? Then the personal data may (or must) be kept in an archive.
There is no retention period for personal data in an archive. There is an exception to this rule: if the Archives Act or any other law applies, a retention period does apply. The data must then be destroyed if they are no longer required for the purpose of the archive. Think, for example, of the diploma register.