How long is ‘no longer than necessary’ for keeping data under the GDPR

20-Jul-2017 17:01:42 / by Cynthia Lai

Cynthia Lai

The General Data Protection Regulation states that personal data must be kept “no longer than is necessary for the purposes for which the personal data are processed” [Art.5(1)(e)]. This implies there’s a time limit on how long customers’ data can be kept. But this vague statement begs the question: “’how long’ is ‘longer than necessary’”?

If the data is captured for the purpose of direct marketing, part of this justification could be that brands should be allowed to store the data for as long as the individual can be considered a customer. So the question really is: For how long after completing a purchase can the individual be considered a customer?

To provide an answer for the home shopping sector, we carried out analysis across the Abacus Alliance to measure how the likelihood of repurchasing changes with the passing of time. On analysing 500 million transactions, we found that 90% of the individuals who repurchased with the same brand did so within 50 months.

While this provided a starting point to give members insight they could use to justify timeframes for keeping data, it seemed too broad, as different products have different lifecycles. To gain greater clarity, we broke this down by seven categories on the Abacus Alliance.

Guidance on keeping your data by category

The following time periods identify the point in time at which 90% of returning customers have repurchased:


  • Entertainment, Books and Collectables 
3 years 5 months (41 months)
  • Clothing 
3 years 8 months (44 months)
  • Home Interiors
4 years 2 months (50 months)
  • Gadgets & All Gifts
4 years 4 months (52 months)
  • Household Goods
5 years 6 months (66 months)
  • Food & Wine
5 years 11 months (71 months)
  • Gardening
6 years 9 months (81 months)


Ultimately, each company needs to decide how long it will keep personal data. Based on the analysis, part of the justification could be that brands should be allowed to keep customers’ data for at least the length of time defined above. That’s because, up to that point, there is a significant probability the customer will re-engage with the brand. The brand, therefore, has a legitimate interest to use direct marketing to inform the customer about its products and offers.

An average only tells part of the story

While the category-level analysis provides a more pertinent benchmark, ultimately each company has its own specific cut-point. This will be true if your brand offers products in a category with longer than average lifecycles, or if your customers are very loyal. In these cases, there’s a good chance that the gap between purchases of your brand might be longer than the average for your category.To give members even more accurate insights, we have created the Customer Lifecycle Report. This report will give a tailored measurement of the lifecycle of your customers, which you can use to make a grounded decision regarding your data retention policy.

To find out how to get a Customer Lifecycle Report, please contact your account manager.  

View GDPR resources


Want to find out more about the GDPR?  This is an area we’ll be covering at our October Insights Conference. To book your place, please click here.