Analysis published October 15, 2026; Berlin court judgment June 2026
Keeping Data Just in Case Is Now a Fine Risk: GDPR Storage Limits Meet DORA Registers
Two October analyses of European retention practice make the same point from the same principle: GDPR Article 5(1)(e), the storage limitation principle, allows personal data to be kept in identifiable form only as long as its original purpose requires, and breaching the Article 5 principles sits in the upper fine tier of up to EUR 20 million or 4 percent of worldwide annual turnover, even when no breach or data loss ever occurs. The regulation sets no number of years, so each organization must set a period per data category, document why, and prove deletion actually happened on schedule. The example both analyses cite is Deutsche Wohnen: in June 2026 a Berlin court found the property company had intentionally failed to update its systems in time to delete former tenants' payslips, bank statements, and identity documents, and imposed a EUR 900,000 fine, well below the roughly EUR 14.5 million originally set by the data protection authority in 2019, in a judgment that is not yet final. The surrounding rules do not simplify the schedule: DORA requires financial entities to keep a register of ICT third-party arrangements but sets no retention period for its entries, after a proposed five-year rule for terminated arrangements was dropped, and log retention under national NIS2 implementations ranges from at least 90 days in Lithuania to at least 18 months for certain services in the Czech Republic. Both analyses stress the distinctions firms blur: archiving is not deletion, the retention clock keeps running in restricted storage, and deletion means removal from live systems and backups.
Executives
Over-retention is now a liability with no incident required: the fine risk attaches to keeping data past its purpose, full stop. Storage is cheap, which is why the failure mode is drift, old tenant files, old customer records, and old logs that nobody owns. Assign an owner and a review date to the retention schedule itself, because a policy nobody enforces is the finding, as the Berlin case shows.
CIO / CISO
Build the schedule the way auditors will test it: scope, data categories, a period and a trigger event for each, the legal basis, deletion methods including backups, legal hold handling, and at least annual review. Where regimes conflict, as with the DORA register, which has no set period, document the period you chose and the reasoning. Under ISO 27001, auditors test you against your own documented procedure, so a stated period your systems ignore is self-authored evidence.
Engineers
Automate deletion where possible and log it where not: lifecycle rules on object storage, mailbox and log retention jobs with completion records, and backup rotation that actually expires data instead of preserving it indefinitely. Separate the three operations in code and in reporting, retain, archive, delete, and produce evidence of deletion runs that a reviewer can sample.
Everyone (non-IT)
Companies holding your old records longer than they need them is no longer just untidy. In Europe it can be fined even if nothing is ever stolen, because every extra year a file exists is another year it can be exposed. You can ask organizations what they hold about you and how long they keep it.