A Specific Retention Period

The response gives a retention period for the person's personal data, rather than only the criteria for deciding one.

Criterion: E14
Level: Level 3
Domain: Supplementary Information
Reflects: Article 15(1)(d)

Intent

Criteria for deciding a retention period leave the person doing the organisation's arithmetic. A date or a period tells them when the data goes.

How to test it

An assessor scores the criterion against a single response:

Score 2: The response gives a retention period for each category of the person's personal data.
Score 1: The response gives a period for some of the person's personal data and only criteria for the rest.
Score 0: The response gives only the criteria for deciding, or says nothing about how long the data is kept.

The law it reflects

This criterion reflects Article 15(1)(d) of the UK GDPR. That mapping is a guide, not a legal test: conformance is judged against the criterion, not the article.

See E14 in context in the full standard.