Data Retention Periods in Ireland: Retention Schedule Guide
Last updated 28 October 2026. General information only, not legal advice.
Keeping personal data “just in case” is one of the most common GDPR weaknesses in Irish businesses. Old customer files, former-employee folders and years of email archives all count as personal data, and every extra year they sit there adds risk. A retention schedule is the practical tool that fixes this. This guide explains what GDPR requires, which Irish rules set minimum periods, and how to build a schedule your business can actually follow.
What GDPR says about keeping data
The storage limitation principle in Article 5(1)(e) of the GDPR says personal data must be kept in a form that identifies people for no longer than is necessary for the purposes it was collected for. The Data Protection Commission (DPC) explains that controllers should set time limits for erasure or periodic review, and keep storage to a strict minimum.
Importantly, GDPR does not give a list of retention periods. The DPC’s guidance says the period is a matter for each controller to decide, based on its own circumstances and reasons for keeping the data. That flexibility comes with a duty to be able to justify your choices (Article 5(2), accountability).
Three other GDPR provisions link directly to retention: Article 13(2)(a) requires you to tell people the period you will keep their data, or the criteria used to set it; Article 17 gives people a right to erasure in certain circumstances, including when data is no longer necessary; and Article 30 expects your record of processing to show, where possible, the envisaged time limits for erasure. Our guide to the record of processing activities covers the last of these.
Irish laws that set minimum periods
Where a law requires you to keep a record, that is usually a valid reason to retain the personal data in it for that period. Examples that commonly apply to Irish businesses include:
- Company accounting records: section 285 of the Companies Act 2014 requires accounting records and certain returns to be kept for at least six years after the end of the financial year they relate to.
- Working time records: section 25 of the Organisation of Working Time Act 1997 requires employers to keep specified records for at least three years from the date they were made.
- Tax and payroll records: Revenue generally expects tax-related records, including payroll records, to be kept for six years. Check the current Revenue guidance for your situation.
- Anti-money laundering records: designated persons under section 55 of the Criminal Justice (Money Laundering and Terrorist Financing) Act 2010 must keep customer and transaction records for at least five years, as noted in the DPC’s own FAQs.
Other sectors, such as healthcare, childcare, financial services and education, have their own rules. If you are in one of those, check your sector regulator’s guidance. A minimum legal period is not the same as a maximum: once it ends, you still need a reason to keep the data.
How to build a retention schedule
1. List your data categories
Start from your records of processing, or run a quick data-mapping exercise. Typical categories include customer records, marketing lists, job applicant CVs, current and former employee files, supplier contacts, CCTV footage, website logs, and financial records.
2. Record the purpose and lawful basis
For each category, note why you hold it and under which Article 6 lawful basis (and Article 9 condition for special-category data). The purpose drives how long you can justify keeping it.
3. Set a period and write down the reason
Choose a period for each category and record the reason: a statutory minimum, a limitation period for legal claims, a contractual need, or a business need. “We might need it one day” is not a reason that will stand up to scrutiny. Where the law does not set a period, a defensible approach is to tie it to the relevant limitation period for claims or to a clear business need, and to document your thinking.
4. Define the trigger point
State when the clock starts: end of the customer relationship, end of employment, end of the financial year, or date of collection. Unclear triggers are why records are often kept indefinitely.
5. Decide what happens at the end
Specify the disposal method: secure deletion, shredding, or anonymisation where the data is still useful in non-identifiable form. Include backups, archives, devices, paper files and data held by your processors.
6. Assign ownership and review
Give each category an owner, and schedule a regular review. Many businesses run a deletion sweep once or twice a year. Train staff so the schedule is followed in practice, not just filed away. Our GDPR compliance checklist shows where retention fits among the other core tasks.
A simple example layout
A schedule can be a table with these columns: data category, purpose, lawful basis, retention period, reason or legal source, trigger, disposal method and owner. Keep it short enough to be used. For instance, a row for payroll records might cite the Revenue six-year expectation, with the trigger being the end of the relevant tax year; a row for unsuccessful job applicants would set a shorter, justified period and note the reason.
Common mistakes
- Applying one blanket period (for example “seven years”) to everything.
- Ignoring email, shared drives, backups and cloud tools.
- Forgetting to tell individuals the retention period in your privacy notice.
- Having a schedule that nobody follows, with no deletion logs.
- Deleting data that is subject to a legal hold or an open access request. Our guide to data subject access requests explains why you must not delete data to avoid disclosure.
- Keeping excessive CCTV or monitoring data. See our guides on CCTV and employee monitoring for those specific areas.
Where retention sits in your wider compliance
Retention is one part of a broader programme that includes your records of processing, privacy notices, processor contracts, security measures and breach response. For an overview, see our GDPR and data protection guides hub. A self-complete option for many small businesses is the GDPR Compliance Pack for Irish SMEs, which includes template documents you can adapt.
Need help with this? Plus Promotions Limited provides GDPR audit and gap analysis for Irish businesses, from €495. This can include reviewing how long you keep personal data against what you have documented.
Frequently asked questions
How long should a business keep personal data under GDPR?
GDPR sets no fixed period. Article 5(1)(e) says personal data should be kept in identifiable form for no longer than necessary for the purpose. Each controller decides and documents its own periods, taking account of any legal minimums.
What is a data retention schedule?
A data retention schedule is a document listing each category of personal data, the purpose it is held for, how long it is kept, the reason for that period and what happens at the end, such as secure deletion or anonymisation.
Do I have to delete personal data when the retention period ends?
Yes, in general. Once data is no longer necessary for its purpose and no legal requirement or legitimate need to keep it applies, it should be deleted or anonymised. Make sure backups and processors are covered too.
Is a data retention policy mandatory in Ireland?
GDPR does not use the phrase “retention policy”, but you must be able to show compliance with storage limitation (Article 5(2)), and you must tell people how long you keep their data (Article 13(2)(a)). In practice a written retention schedule is the usual way to do both.
What is the difference between a retention schedule and a ROPA?
A record of processing activities (ROPA) under Article 30 describes what processing you do and, where possible, the envisaged time limits for erasure. A retention schedule goes into detail on each category: the period, the reason and the disposal method. The two should be consistent with each other.
OnlineLegalServices.ie is not a solicitor’s practice and does not give legal advice. Our data protection services are compliance consultancy. For legal advice on your own situation, speak to a solicitor.
