# Standards and Regulatory References — Retention Exception Management

## Primary Legislation

### GDPR (Regulation (EU) 2016/679)
- **Article 5(1)(e)** — Storage limitation: exceptions must not undermine this principle
- **Article 5(2)** — Accountability: documented justification for every exception
- **Article 17(3)** — Enumerated exceptions to the right to erasure (provide framework for legitimate retention exceptions)
- **Article 89(1)** — Safeguards for archiving, research, and statistical purposes (basis for research-related retention exceptions)
- **Recital 39** — Time limits for erasure or periodic review; exceptions require structured review

### UK Data Protection Act 2018
- **Schedule 2, Part 6** — Research, archiving, and statistical exemptions
- **Section 19** — Exemption for scientific or historical research purposes

## Regulatory Guidance

### ICO (UK Information Commissioner's Office)
- **Accountability Framework** — Documented processes for retention decisions including exceptions
- **Storage limitation guidance** — Controller must demonstrate necessity for any data retained beyond standard period

### EDPB (European Data Protection Board)
- **Guidelines 4/2019 on Article 25 Data Protection by Design and by Default** (adopted 20 October 2020) — Storage limitation as a by-design requirement; exceptions must be engineered with controls
- **Guidelines 05/2020 on consent under Regulation 2016/679** — Interaction between consent withdrawal and retention exceptions

## Technical Standards
- **ISO/IEC 27701:2019 Section 7.4.5** — PII de-identification and deletion; exception management within PIMS
- **ISO/IEC 27001:2022 Annex A Control A.5.1** — Policies for information security (includes retention exception policies)
- **NIST Privacy Framework 1.0** — CT.DM-P: Data minimization function; exception management as a control