5 Excuses That Lead to Over-Retention of Data... and Risk!

The Rise of Data Subject Access Requests

People’s right to request a copy of their personal data from both private and public sector organizations has been part of privacy and data protection law since the 1980s. Awareness has grown significantly in recent years, largely driven by GDPR, which has increased global understanding of data subject access requests (DSARs) and access rights.

As a result, many organizations are experiencing a significant rise in the number of requests or are receiving such requests for the first time. While organizations have introduced portals and workflows to handle these requests, relatively few have addressed the underlying structural challenges.

There is also an inherent tension between retaining data for valid business and legal purposes and disposing of it appropriately according to a defined schedule. A defensible approach requires a structured program based on clear principles and best practices to guide data retention decisions.

Reasons Over-Retention of Data Happens

A key cultural challenge in many organizations is the “we might need it later” mindset. Employees often hesitate to delete data for several reasons:

• “We might need it later.”
  Uncertainty about future needs, fear of scrutiny, or lack of clarity on data usefulness.
• “Not my responsibility.”
  Lack of clear accountability for data management across staff.
• “I don’t have time for this.”
  Retention schedules often exist as static documents without actionable workflows.
• “I don’t know what to do.”
  Complex legal tables are difficult for non-experts to interpret.
• “I don’t know why it’s such a big deal.”
  Insufficient training and awareness about the risks of indefinite retention.

Over-Retention Leads to Unnecessary Risk

Organizations face multiple risks related to poor data retention practices:

• Keeping data too long or too briefly
• Inability to respond accurately and promptly to DSARs
• Exposure of weak retention practices during audits or investigations
• Increased impact in the event of a data breach
• Higher storage and operational costs
• Increased complexity in search and discovery processes

Information Security Risks of Data Over-Retention

The consequences of a personal data breach are more severe when excessive data is retained:

• Larger volumes of affected records
• Increased likelihood of regulatory penalties if data was retained unlawfully
• Greater reputational damage
• Potential legal action from data controllers (for processors)

Breaches can also trigger customer complaints and legal claims, especially if data was retained longer than necessary.

Data Protection Risks of Data Over-Retention

Data protection risks arise from two main areas:

1. Storage Limitation Principle

Privacy laws (e.g., GDPR Article 5(1)) require organizations to retain data only as long as necessary. Organizations must understand and demonstrate:

• What data they hold
• Why it was collected
• Legal or business obligations for retention
• When and how data should be disposed of

2. Individual Access Rights

Individuals have the right to access their personal data:

• DSARs enable individuals to verify lawful data processing
• Laws like GDPR and CPRA grant access rights
• Processors must assist controllers in fulfilling these requests
• Individuals may also request deletion, withdraw consent, or object to data usage

Legal Risks of Data Over-Retention

Legal retention periods exist to:

• Preserve evidence for claims, litigation, or regulatory action
• Limit how long organizations can be held accountable

Failure to retain data for required periods can result in non-compliance and legal exposure.

Commercial Risks of Data Over-Retention

Certain data must be retained for contractual or business purposes, such as:

• Customer transactions and service records
• Warranty or guarantee documentation
• Contractual obligations between controllers and processors

Failing to retain such data can lead to disputes, complaints, or regulatory consequences.

Consumer and Access Request Risks of Data Over-Retention

Organizations are expected to:

• Respond to customer inquiries and complaints
• Manage preferences and service requests

Even without legal mandates, data should be retained long enough to meet reasonable customer expectations—but not longer than necessary after a relationship ends.

Reputational Risks of Data Over-Retention

All of the above risks can ultimately damage an organization’s reputation if it fails to meet:

• Legal obligations
• Contractual commitments
• Customer expectations