Data retention in outsourcing: when to archive, delete and require evidence
“We delete data when the contract ends” is not enough. Define the clock, owners, exceptions, deletion method and evidence for every data category.
Outsourced data tends to multiply. An input file may appear in a production system, backup, report, archive and transfer folder. A paper document may produce a scan, a working copy and dispatch evidence. If the agreement only says that data is kept “for as long as necessary”, the client and provider may interpret that period differently.
The GDPR storage-limitation principle requires personal data to remain identifiable only as long as necessary for its purpose. It does not set one universal number of years. The period follows from purpose, legal basis, sector obligations, evidential needs and the real workflow. Retention must therefore be designed with the process, not added after go-live.
Retention is a lifecycle, not a single date
| State | Purpose | Access | Exit trigger |
|---|---|---|---|
| Active | current case delivery | operations team | case or batch closure |
| Intermediate archive | claims, settlement, evidence | restricted, on request | relevant period expires |
| Hold | dispute, audit, legal hold | named roles | formal release decision |
| Deleted or anonymised | no further need | no personal-data access | completion evidence |
CNIL describes a comparable cycle: active database, intermediate archive, then final archive or deletion. Moving a file into a folder called “archive” does not limit retention if it remains broadly available and used like active data.
Decision rights and execution
The controller determines the purpose, legal basis and retention period. The processor follows documented instructions, protects the data and helps demonstrate compliance. Article 28(3)(g) GDPR requires the processor, at the controller's choice, to delete or return personal data after the services end and delete existing copies unless law requires storage.
“After the contract ends” is too vague. Is the trigger the final mailing, claim closure, monthly settlement, access expiry or termination of the entire agreement? Different categories need different clocks.
Build a retention matrix for real data
Cover primary documents and temporary files, logs, reports, samples, backups, messages and physical media. For each item record:
- category and purpose;
- legal or contractual basis;
- locations such as production, e-COK, email, backup and paper archive;
- start trigger such as creation, case closure or contract expiry;
- active and archive periods;
- decision owner;
- disposition through return, deletion, destruction or irreversible anonymisation;
- evidence such as a log, batch report or certificate.
Do not assign one period to everything. A one-off address file, access log, correspondence scan and accounting document serve different purposes and may face different requirements. Confirm statutory periods with legal counsel or the data protection officer for the relevant sector.
Legal hold must be a controlled exception
A dispute, complaint, audit or duty to preserve evidence may temporarily stop deletion. Record a case ID, basis, scope, owner, review date and release condition. Without those controls, “keep it just in case” becomes permanent policy. A hold should cover only necessary information; after release, the normal schedule resumes.
Backups cannot remain a blind spot
Immediate selective deletion from every backup may be technically impossible or harm backup integrity. That does not justify indefinite storage. The agreement should describe overwrite cycles, restricted access, a ban on restoring deleted data to normal use and a method for reapplying deletion after an environment is restored.
A backup restores a system after failure; an archive provides controlled access to older information. Using backups as convenient archives undermines retention control.
Secure deletion depends on medium and risk
Deleting a file or emptying a recycle bin does not always make recovery infeasible. NIST SP 800-88 Rev. 2, published on 26 September 2025, recommends a risk-based media-sanitisation programme. It distinguishes approaches such as logical clearing, stronger purging and physical destruction. The right method depends on technology, future media use and required assurance.
Paper requires a closed chain: batch identification, secure container, controlled handover, appropriate destruction and confirmation. Electronic scope must consider systems, replication, device memory, user exports and logs. One command rarely covers every copy.
Evidence without creating another data store
A deletion record should normally state client or process identifier, data category, date or batch range, locations, method, execution date, operator, verification result and exceptions such as an active hold or backups awaiting overwrite. Aggregate reporting with drill-down where justified can demonstrate performance without copying personal data into the evidence itself.
Put retention into the outsourcing agreement
Link the retention matrix to responsibilities and SLA. Define purge frequency, ad-hoc request time, backup treatment, legal hold, data return, exit deletion, subcontractors, paper media and reporting. Connect it with subcontractor governance and the audit trail.
A 30-day implementation plan
- Inventory categories and locations, including exports and paper.
- Assign purpose, basis, trigger and owner.
- Separate active use from intermediate archive.
- Define holds and backup cycles.
- Choose sanitisation by medium and risk.
- Pilot one closed batch.
- Verify logs, evidence and exceptions.
- Review the matrix quarterly and after system changes.
If you are organising correspondence, scans and proof of delivery, explore business mail handling and e-COK. Talk to BackOffice Outsourcing about scope, reporting and control points before the first data batch enters production.
Sources
- Regulation (EU) 2016/679 - GDPR, Articles 5, 17 and 28
- CNIL, Define a data retention period
- NIST SP 800-88 Rev. 2, Guidelines for Media Sanitization, 26 September 2025
Frequently asked questions
Does the GDPR prescribe one retention period?
No. Retention depends on purpose, legal basis, sector rules and evidential needs. The organisation must be able to justify each period.
Must every backup be edited immediately after a deletion request?
The procedure should address backup design, overwrite cycles and restricted use. Restored environments must not return deleted data to ordinary processing.
What should deletion evidence contain?
At minimum: scope, data category, locations, method, date, operator, verification result and justified exceptions.
Who owns retention in outsourcing?
The controller determines purposes and periods; the processor implements documented instructions. The contract must allocate decisions, execution, reporting and exceptions.