TL;DR
501 retention rules across nine jurisdictions, each with its own source. Of 232 Portuguese rules only 99 have a numeric duration: the others depend on an event, overlap, or the law says nothing and the controller decides. Verification status is shown entry by entry.
The hardest question to answer
How long do you keep a payslip? And the CV of a candidate you did not hire? And the CCTV recordings? These are the first questions a controller asks, and the ones on which the Art. 30 register most often stays vague: «for as long as necessary». Under review that formula does not hold, because Art. 5(1)(e) asks for a period, and the period depends on the category of data and on the jurisdiction.
Why it is not a table of years
Of the 232 Portuguese rules, only 99 have a precise duration expressible as a number and a unit. The other 133 are periods that run concurrently, periods triggered by an event, retention with no numeric limit, or cases where the law fixes nothing and the controller decides. A field saying «duration: 7 years» would have forced the invention of a number where the law has none, which is the fastest way to build fake compliance.
- 99 rules with a structured duration, 57 with a composite duration, 36 with no numeric period, 23 left to the controller's decision, 17 tied to an event or a condition.
- 34 domains, from healthcare to anti-money-laundering, from CCTV to regulated professions.
- Every entry states its source, when the period starts running, what happens to the data at the end, and the cautions that apply.
Verification status is shown, not hidden
Of the 232 Portuguese rules, 137 are marked «Verificado» and 95 «Referência corrente». The distinction is the author's and stays visible to the reader: an entry is not promoted to verified without a fresh consultation of the primary source. Showing that almost half the entries are still at current-reference level looks counterintuitive, and is in fact the only thing that makes the content trustworthy — because it says where to look twice.
How a jurisdiction's law enters the platform
The Portuguese matrix is content by Luis Ferreira Mendes (Ferreira Mendes Unipessoal Lda), version FM-D07-01 v16.0, adapted by him for the platform and transcribed without changes to its substance: wording, sources, verification status and cautions are his, word for word. It is the model by which other jurisdictions will follow: a professional from the country, their version, their name on it.
How it should be used
Legal retention references are operational guidance and should be assessed against the specific context of each processing activity. A statutory rule states the maximum period, not that every field must be kept for it: a ten-year maximum does not justify keeping every piece of data for ten years, only those necessary for the purpose that justifies the period. In the register, the rule you pick is captured with its version: if the matrix changes tomorrow, the record still says which text the decision was based on.
The person who sets the period and the person who actually deletes the data are often two different people, and the platform keeps the two apart: it is a distinction that usually gets blurred, and the first one asked for when a review arrives.
Looking for a workspace for your DPO work?
DPO Workspace is built by a certified DPO. 30-day free trial.
Start free
