# Standards and Regulatory References — Retention Impact Assessment

## Primary Legislation

### GDPR (Regulation (EU) 2016/679)
- **Article 5(1)(e)** — Storage limitation: proactive determination of retention periods
- **Article 25(1)** — Data protection by design: implement storage limitation at design stage
- **Article 25(2)** — Data protection by default: only data necessary for each specific purpose processed by default
- **Article 35(7)** — DPIA content: necessity and proportionality assessment includes retention
- **Article 13(2)(a)** — Transparency: inform data subjects of retention period or criteria
- **Article 14(2)(a)** — Transparency for data not obtained from data subject
- **Article 30(1)(f)** — ROPA: envisaged time limits for erasure
- **Recital 39** — Time limits for erasure or periodic review
- **Recital 78** — Data protection by design measures including data minimization

### UK Data Protection Act 2018
- **Section 57** — Data protection impact assessment requirements
- **Section 39** — Data protection principles including storage limitation

## Regulatory Guidance

### ICO (UK Information Commissioner's Office)
- **DPIA guidance** — Retention period determination as part of DPIA process
- **Accountability framework** — Documented retention decisions for all processing activities
- **Data protection by design guidance** — Proactive retention period setting

### EDPB (European Data Protection Board)
- **Guidelines 4/2019 on Article 25 Data Protection by Design and by Default** (adopted 20 October 2020) — Storage limitation as a mandatory by-design measure; retention must be determined before processing begins
- **Guidelines on Data Protection Impact Assessment (DPIA)** — Retention assessment as part of DPIA
- **Guidelines 3/2019 on processing of personal data through video devices** — Specific retention guidance for CCTV/video (illustrative of category-specific assessment)

### CNIL (France)
- **CNIL retention period recommendation tool** — Reference retention periods by data category and purpose

## Technical Standards
- **ISO/IEC 27701:2019 Section 7.2.2** — Identify purposes: determine retention periods at purpose identification stage
- **ISO/IEC 27701:2019 Section 7.4.5** — PII de-identification and deletion planning
- **NIST Privacy Framework 1.0** — ID.IM-P: Data processing purposes and retention limits identified
- **ISO 31700:2023** — Privacy by design for consumer products: retention as a by-design consideration