Pro Tier Module
GDPR Data Retention Period Calculator
Exact GDPR storage-limitation deadlines from a cited, jurisdiction-confirmed period - no EU-wide guess.
This tool runs inside GDBS Pro. What it computes and the authorities it applies are below.
The problem
Data protection officers and privacy counsel must compute deletion deadlines under GDPR Art 5(1)(e) where the concrete period comes from member-state tax, employment, and limitation law, not a single EU number. Assuming one wrong period silently mis-dates an entire erasure schedule.
The local-first solution
This plugin computes retention-end and deletion-deadline dates by exact UTC calendar arithmetic over a retention period you confirm as a dated, jurisdiction-indexed input, citing the member-state statute it used and running entirely client-side with no personal data uploaded.
What it does
Retention-end date computed as trigger date plus a confirmed, cited member-state period
Deletion deadline as retention-end plus an optional grace/disposal window
Per-jurisdiction, per-category default periods each citing the controlling statute (tax, commercial, employment law)
Consent-withdrawn outcome: retention ends immediately at the withdrawal date (Art 7(3), Art 17(1)(b))
Open-ended 'until withdrawn / no fixed period' handling that returns a review cadence rather than inventing a number
Exact whole-day and true month/year calendar adds with month-end clamping and no timezone drift
Honest scope
Not legal advice: Art 5(1)(e) fixes the principle while the concrete number is set by member-state law and the controller's documented schedule, which you confirm per category. The calendar arithmetic, consent-withdrawal, and open-ended handling are exact; every default period is a cited member-state figure you confirm rather than an EU-wide constant, and legal-hold suspension, sector overlays, cross-border transfers, the controller-vs-processor split, and the necessity judgement itself are flagged, not computed.
Authorities cited
- GDPR (Regulation (EU) 2016/679) Art 5(1)(e) - Storage limitation: personal data kept in a form permitting identification of data subjects for no longer than is necessary for the purposes for which they are processed.
- GDPR Art 6(1)(a)-(f) - Lawfulness of processing: the six legal bases (consent, contract, legal obligation, vital interests, public task, legitimate interests).
- GDPR Art 7(3) - The data subject has the right to withdraw consent at any time; withdrawal must be as easy as giving consent and does not affect prior lawful processing.
- GDPR Art 17(1)(a)-(b) - Right to erasure ("right to be forgotten"): erasure where data are no longer necessary, or where consent is withdrawn and there is no other legal ground for the processing.
- Germany - Abgabenordnung (AO) sec. 147(3): 10-year retention of books, records, inventories, balance sheets and booking documents; Handelsgesetzbuch (HGB) sec. 257(4): 10 years for commercial books / 6 years for business letters.
- France - Code de commerce art. L123-22 (10-year accounting books); Livre des procedures fiscales art. L102B (6-year tax records); Code civil art. 2224 (5-year general civil prescription); Code du travail art. L3243-4 (payslip copy retention).
- United Kingdom (UK-GDPR + DPA 2018) - Limitation Act 1980 s.5 (6-year simple-contract limitation) and s.8 (12-year limitation for a deed); Companies Act 2006 s.388 / HMRC record-keeping duties.
- Ireland - Taxes Consolidation Act 1997 s.886 (6-year tax-record retention); Statute of Limitations 1957 s.11 (6-year contract/tort limitation).
- EDPB / Art 29 WP guidance on storage limitation and erasure - the period must derive from a documented purpose-necessity assessment and a written retention schedule, not a generic constant.
Get an email when these rules change
Tables, thresholds and deadlines in Compliance & Risk change every year. Leave your email and we will tell you when the ones behind tools like this one move, at most once a month.
We email you once to confirm. After that, unsubscribe from any issue in one click. Your address goes to VaultSync only (privacy).
Calculate a deletion deadline
Compute the deadline in your browser and route the dated schedule into a Sandbox workspace, a Worklog case file, or a Gate client portal. Nothing is uploaded to anyone's cloud.