TL;DR
Art. 5(1)(e) GDPR requires storage limitation. The CNIL breaks that principle into three phases: active base (the time needed to achieve the purpose), intermediate archiving (file closed but still of administrative interest or subject to a legal obligation — with mandatory physical or logical separation) and permanent archiving (processing for archiving purposes in the public interest). The sectoral reference frameworks give durations: mandatory where a legal text imposes them, recommended otherwise. Applying the recommended ones creates a presumption of conformity; departing from them is allowed provided the choice is documented.
One item of data, three lives
The active base is the time needed to achieve the purpose that justified collection. There the data is accessible in the immediate working environment of the operational teams: HR for a recruitment, sales for a customer. The CNIL's example is the unsuccessful candidate, whose data is kept for a maximum of two years unless erasure is requested.
Intermediate archiving starts when the file is closed. The data no longer serves the objective but retains an administrative interest — handling possible litigation — or answers a legal obligation: invoicing data is kept for ten years under the Commercial Code even when the person is no longer a customer. In that phase it may be consulted only occasionally and with a stated reason, by specifically authorised people.
Permanent archiving concerns only processing carried out for archiving purposes in the public interest. Unlike the active base, the last two phases are not automatic: their necessity is assessed processing by processing, and for each a selection must be made among the data.
The sentence everybody skips
“If intermediate archiving is necessary and justified, a separation from the active base must be carried out.” That separation is physical — extracting the data into a dedicated archive accessible only to authorised people — or logical: the data stays where it is but is isolated by a restriction of permissions that makes it inaccessible to those who no longer have an interest in processing it. A record declaring ten years of retention while the data sits in the CRM, visible to the whole sales team, does not describe intermediate archiving: it describes ten years of active base, which is a different thing and rarely justifiable.
- The same item of data can belong to two distinct processing operations with two different periods: archiving or deleting it in one does not prevent continued use in the other.
- Where a legal text fixes the duration, it governs — Art. L3243-4 of the French Labour Code requires the employer to keep a duplicate payslip for five years.
- The CNIL frameworks cover health outside research, health research, the social and medico-social sector, and human resources management. They list only the most frequent operations: a processing activity absent from the framework is not a processing activity without a period.
- The provisions collected in the frameworks concern national law only: a company established in several States must check the other applicable legislation.
“Statutory periods” is not a retention period
It is the most common wording in records, and it says nothing: not which phase, not which text, not when the clock starts. A usable retention period has three elements — the phase, the number of years or months, and the reference that grounds it, whether legislation or regulatory doctrine. Without the third nobody can check the first, and an unverifiable record does not protect the person who produced it: it documents their approximation.
The CNIL's practical guide was written with the French interministerial archives service, precisely because the GDPR and the Heritage Code do not say the same thing and a public body has to hold both. For processing with no period fixed by a text, the guide offers an analysis grid starting from the purpose — which covers most processing, and is the work the framework does not do for you.
Looking for a workspace for your DPO work?
DPO Workspace is built by a certified DPO. 30-day free trial.
Start free
