Data Retention Periods by Category for SMBs

How long should you keep customer data, job applicants, invoices, or CCTV footage? Here are the key categories in a clear overview table, with the source for each retention period.

Data must not be kept longer than necessary. What "necessary" means differs by category. Here are the guidelines for common SMB data categories.

Financial (tax)

• Invoices, receipts, annual accounts: 7 years (tax).
• Real estate records: 10 years (tax).
• Payroll records: 5 years (after end of employment).

Customer data

• Customer file – active contract: duration of contract + statutory retention obligation.
• Customer file – after contract ends: 2 years (warranty claims, follow-up), then anonymise.
• Customer invoice history: 7 years (tax).
• Support tickets: 1–2 years.
• CRM notes: 2 years after last contact.

HR

• Salary data: 7 years (tax).
• Employment contract: 7 years after termination.
• Performance reviews: 2 years after end of employment.
• Absence/sickness records: 2 years after end of employment.
• Rejected applicants: max 4 weeks, or 1 year with consent.
• See personnel file retention.

Website / marketing

• Newsletter subscriptions: as long as the opt-in remains active.
• Analytics logs (GA): 14 months by default, adjustable.
• Web forms: 30 days unless there is a specific processing purpose.
• Cookie consent log: 3 years.

CCTV / camera surveillance

• Maximum 4 weeks, unless a specific incident has occurred.

Incidents

• Data breach register: 3 years.
• Incident log: 3–5 years (see incident log).

See also: GDPR pillar, processing register.