Deciphering Data Retention Policies

Assigning appropriate retention periods to categories of personal data is one of the fundamental principles of the General Data Protection Regulation (Regulation (EU) 2016/679) (the "GDPR").  The requirement to designate clear retention periods emanates from the aptly named 'storage limitation principle' found within Article 5 of the GDPR.  This principle requires data controllers to deidentify data subjects once the purposes for processing their personal data have either concluded, expired, or lapsed.  Unfortunately, experience dictates that data controllers find it particularly difficult to comprehend, let alone comply with this principle, and this is mainly due to the fact that the GDPR does not include pre-set retention periods, nor does it include instruction on how to calculate them. Indeed, it is often the case that once respective retention periods have been determined, data controllers have to significantly overhaul their systems, (both in terms of legacy