# Storage Limitation Standards and Regulatory References

## Primary GDPR Articles

### Article 5(1)(e) — Storage Limitation
Personal data shall be kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed; personal data may be stored for longer periods insofar as the personal data will be processed solely for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) subject to implementation of the appropriate technical and organisational measures required by this Regulation in order to safeguard the rights and freedoms of the data subject.

### Article 13(2)(a) — Retention Period Disclosure
The controller shall, at the time when personal data are obtained, provide the data subject with the period for which the personal data will be stored, or if that is not possible, the criteria used to determine that period.

### Article 17(1)(a) — Right to Erasure (Purpose Exhaustion)
The data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her without undue delay where the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed.

### Article 25(1) — Data Protection by Design
The controller shall implement appropriate technical and organisational measures, such as pseudonymisation, which are designed to implement data-protection principles, such as data minimisation, in an effective manner.

### Article 89(1) — Archiving, Research, Statistics Safeguards
Processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes, shall be subject to appropriate safeguards for the rights and freedoms of the data subject. Those safeguards shall ensure that technical and organisational measures are in place in particular in order to ensure respect for the principle of data minimisation.

## Supporting Recitals

### Recital 39
Personal data should be processed only if the purpose of the processing could not reasonably be fulfilled by other means. In order to ensure that the personal data are not kept longer than necessary, time limits should be established by the controller for erasure or for a periodic review.

## Statutory Retention Periods (Selected Jurisdictions)

### Switzerland
- Business records: 10 years (Swiss Code of Obligations Art. 958f)
- Employment records: 10 years after employment end (OR Art. 127-128)
- Social security records: 10 years (AHVG Art. 41)

### European Union
- VAT invoices: 6-10 years depending on Member State (VAT Directive 2006/112/EC Art. 242)
- Anti-money laundering: 5 years after end of business relationship (AMLD5 Directive 2018/843 Art. 40)
- Financial transaction records: 5 years (MiFID II Art. 16(6))

### Germany
- Tax records: 10 years (AO § 147)
- Commercial correspondence: 6 years (HGB § 257)

### France
- Civil limitation period: 5 years (Code civil Art. 2224)
- Consumer contracts: 5 years from delivery (Code de la consommation)

## Technical Standards

### NIST SP 800-88 Rev. 1 — Guidelines for Media Sanitization
Provides guidance on data sanitization methods: clear, purge, and destroy. Applicable to physical deletion of personal data from storage media at the end of retention periods.

### ISO 15489-1:2016 — Records Management
International standard for records management principles including retention scheduling, disposition, and destruction verification.

### ETSI TS 119 511 — Policy and Security Requirements for Trust Service Providers
Requirements for long-term preservation services, relevant to archival tier storage of personal data under statutory retention obligations.