Storage Limitation
What is Storage Limitation?
The principle under GDPR Article 5(1)(e) that personal data should be kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data is processed.
Terms that appear alongside storage limitation
Each of these is named in at least one of the same controls as storage limitation. The number is how many controls name both.
- purpose limitation 18 shared controls
- integrity 14 shared controls
- confidentiality 14 shared controls
- lawful basis 13 shared controls
- data minimisation 13 shared controls
- consent 12 shared controls
- accountability 12 shared controls
- gdpr 10 shared controls
Frameworks that govern storage limitation
What the standards actually require on storage limitation
Requirements naming storage limitation across 6 standards, quoted from the control text.
Art.12 fairness and transparency; Art.13 purpose limitation; Art.14 accuracy; Art.15 storage limitation - personal data shall be kept for no longer than is necessary for the purposes for which it is processed.
ETH-PDPP-Art.12-15 · Fairness/transparency, purpose limitation, accuracy, storage limitation →Data collected for specified, explicit, legitimate purposes; adequate, relevant, not excessive; kept no longer than necessary.
MALABO-Art13-P3 · Principle of Purpose, Relevance and Storage Limitation →Schedule 1, Fifth Principle: personal data must not be kept for longer than is necessary for the purpose(s) for which they are processed.
CAYDPA-P5 · Fifth Principle - Storage Limitation →A controller collecting personal data for research must determine before processing how long the data will be processed or the criteria for that period and inform data subjects, noting uncertainties such as the length of longitudinal studies;
edpb-guidelines-1-2026-on-processing-of-personal-data-for-scientific-research-purposes::3.2 · 3.2 Storage limitation: determine and communicate the period before processing, store for specified future research only, review necessity and format →Standard 5 per Section 23 + the Schedule of the Jamaica Data Protection Act 2020: Personal data shall be kept for no longer than is necessary for the purposes for which they are processed.
JM-DPA2020-Standard5-Retention-Sec23-Time-Limit-No-Longer-Than-Necessary-Erasure-Deletion-Anonymisation · Jamaica DPA 2020 Standard 5 - Retention + Section 23 + Time Limit + No Longer Than Necessary + Erasure + Deletion + Anonymisation + Retention Schedule + Legal Hold + Backup Considerations + Storage Limitation →Only data strictly necessary, adequate and relevant to the purpose may be processed, and kept only as long as needed for it (4(d)); data may not be kept longer than necessary, with erasure and periodic review deadlines to be set by the supervisory authority, a...
paraguay-law-no-7593-2025-on-personal-data-protection::4(d) · Article 4(d) Minimisation and storage limitation →Questions people ask about storage limitation
What is Storage Limitation?
Why is Storage Limitation important for compliance?
Which compliance frameworks address Storage Limitation?
Where can I learn more about Storage Limitation?
See how Storage Limitation applies across compliance frameworks
Our platform maps 1,016 frameworks with 316K cross-framework control mappings. Explore how this concept is addressed across standards.