LGPD Data Retention: How Long Should Personal Data Be Kept?

The LGPD Does Not Create One Universal Retention Period

This is the most important concept in the entire topic. The LGPD is not a general records-management law that says every customer, employee, marketing or security record must be retained for the same number of years.

Instead, retention is connected to the principles of purpose, adequacy and necessity, and to the end-of-processing rules in Articles 15 and 16.

A useful question is not: “How many years does the LGPD require?”

The useful question is: “For this specific processing purpose, when does the need to keep identifiable data end, and does another lawful reason require or permit continued conservation?”

Article 15: When Does Processing End?

1. The purpose was achieved

Suppose a company collects an identification document solely to verify a one-time eligibility requirement. Once verification is completed, keeping a full copy indefinitely may not be necessary for that original purpose.

The company should ask whether a separate legal or compliance reason justifies continued retention. If not, deletion, anonymization or a narrower retained record may be more appropriate.

2. The defined processing period ended

Some activities are designed with a defined lifecycle: a promotional campaign, temporary event registration, short-term fraud investigation, recruitment cycle or trial account.

The end date should not be merely decorative. When the processing period expires, the organization should execute the documented disposition rule.

3. The data subject communicates termination or withdraws consent

Consent can be withdrawn at any time through a free and facilitated procedure. The withdrawal affects processing that depends on that consent.

It does not automatically mean every system containing any information about the same person must be erased regardless of other purposes. Order records, tax records, fraud records or legal-claim evidence may be governed by different legal bases and retention logic.

4. ANPD orders termination

If processing violates the LGPD, the Agency can determine termination. A retention schedule therefore cannot override a regulatory order or make unlawful processing lawful simply because an internal policy says “keep for seven years.”

Article 16: What Can Be Conserved After Processing Ends?

Article 16 says personal data should be deleted after the end of processing, within the scope and technical limits of the activities, while permitting conservation for four specific purposes.

Legal or regulatory obligation

This is one of the most common reasons for retaining records after an operational relationship ends. But the company should identify the actual rule and the actual record.

Different legal regimes can impose different retention requirements for invoices, tax documents, employment records, regulated financial records, health documentation or sector-specific evidence. The LGPD does not replace those rules with one universal period.

Research-body study

Article 16 expressly allows conservation for studies by a research body and instructs that anonymization be guaranteed whenever possible. This is not a general “analytics forever” exception for any commercial organization.

Transfer to a third party

Article 16 includes lawful transfer to a third party as an allowed conservation purpose, but the transfer must respect the LGPD's processing requirements. This should not be read as permission to sell expired databases after the original purpose has ended.

Exclusive controller use with anonymization

The fourth exception can support keeping anonymized information exclusively for the controller, provided third-party access is barred. Whether data is actually anonymized should be analyzed using the LGPD's anonymization standard rather than simply replacing names with IDs.

How to Build an LGPD Retention Schedule

A retention schedule converts Articles 15–16 into system behavior. The schedule should be built from the Data Map and ROPA rather than from generic legal templates.

What Should a Retention Schedule Contain?

Consent Withdrawal, Unsubscribe and Deletion

Article 8 allows the data subject to revoke consent at any time through a free and facilitated procedure. Article 18 also gives the data subject the right to request deletion of personal data processed with consent, subject to Article 16.

This creates three separate questions:

1. Does the organization stop the future processing that depended on consent?
2. Does the individual request deletion of the consent-based data?
3. Is some information about the same person still lawfully needed for another purpose or basis?

Newsletter example

A person withdraws newsletter consent. The email platform should stop promotional sending for that consent-based purpose. A minimal suppression record may still be appropriate to prevent accidental re-enrollment, but that record needs its own documented purpose, basis, minimization and retention logic.

If the same person is also a customer, the company may still need order or invoice data under separate purposes. The withdrawal does not retroactively erase the transaction itself.

Legal Claims, Investigations and “Legal Holds”

Businesses often say they need to retain everything “in case we get sued.” That is too broad.

The LGPD separately recognizes the regular exercise of rights as a legal basis under Article 7(VI) and, for sensitive data, Article 11(II)(d). Where a concrete dispute, claim, investigation or defense need exists, that can create an ongoing processing purpose that should be documented.

This is conceptually different from saying Article 16 contains a general “litigation hold” exception. Article 16 does not list one in those words.

A defensible legal-hold process should identify:

• the concrete claim or legal risk;
• which records are actually relevant;
• who authorized the hold;
• who may access the preserved records;
• when the hold will be reviewed; and
• what happens when the dispute ends.

How Should Backups Be Handled?

Backups are one of the hardest operational parts of deletion. Article 16 refers to deletion within the scope and technical limits of the activities, but the LGPD does not create a blanket rule that “backups may always be kept forever.”

A practical backup design can distinguish between:

Also restrict access to backup copies and prevent them from being used for unrelated analytics, marketing or product development merely because deletion from backup is technically inconvenient.

Inactive Accounts and “We May Need It Later”

Dormant accounts often become the largest source of unnecessary personal data. A company may have millions of accounts that have not been used for years but are retained because no team owns deletion.

A better model distinguishes:

• active account;
• inactive but recoverable account;
• closed account with limited post-closure retention;
• records retained under legal/regulatory obligations;
• restricted legal-claim or fraud evidence; and
• anonymized historical analytics.

The lifecycle should be visible in the Data Map, ROPA and Retention Schedule.

See How to Build an LGPD Data Map and LGPD ROPA: How to Build a Record of Processing Activities.

Cookie Retention

ANPD's cookie guidance recommends limiting the duration of persistent cookies as much as possible, considering the purpose for which they were collected and will be processed. The Agency also treats retention period as information that can form part of a cookie policy.

That means a cookie inventory should not contain only “necessary / analytics / advertising.” It should also include the actual expiration or retention behavior.

See LGPD Cookie Consent Requirements.

Retention Must Flow Down to Vendors

ANPD's own privacy notice provides a useful governance example: when the Agency shares personal data with operators, it states that operators must store data securely, retain it only for the instructed period and not subsequently share it without prior authorization.

A private company should apply the same basic discipline to its vendor chain.

See LGPD Vendor Compliance.

One Concrete Five-Year Rule: Security Incident Records

Although the LGPD has no universal five-year retention period, ANPD's current Security Incident Regulation creates a specific one: controllers must keep records of personal-data security incidents—including incidents not reported to ANPD or data subjects— for at least five years from the date of the record, subject to additional longer obligations where applicable.

See LGPD Data Breach Notification.

Example Retention Matrix

The durations below are intentionally expressed as decision logic rather than universal legal numbers. A company must insert the periods supported by its actual laws, contracts, risk and business model.

Data Subject Requests and Retention Exceptions

ANPD's current rights guidance says people can request deletion of consent-based data subject to Article 16, and can request anonymization, blocking or deletion of data that is unnecessary, excessive or processed unlawfully.

When a deletion request arrives, do not answer with a generic: “Our policy says we keep everything for seven years.”

Instead:

1. identify each processing purpose involving that person's data;
2. determine which data can be deleted now;
3. identify any separate legal/regulatory or ongoing lawful purpose;
4. restrict retained data to that purpose;
5. propagate deletion/blocking to relevant processors where required; and
6. explain the factual/legal reason where immediate action cannot be taken.

See LGPD Data Subject Rights.

Common LGPD Retention Mistakes

“LGPD says keep data for five years.”

Incorrect as a general statement. Specific rules can impose five years for particular records—ANPD incident records are one example—but there is no universal LGPD five-year period.

“We keep everything until the customer asks us to delete it.”

Too broad. Article 15 can end processing because the purpose was achieved or the data is no longer necessary even without a request.

“We delete everything immediately after consent withdrawal.”

Also too broad. Consent-based processing should stop as required, but other records may remain under different purposes, legal bases or Article 16 conservation rules.

“Backups do not count.”

Backups should be part of the lifecycle and governed by defined rotation, access and restoration controls.

“Our vendor decides retention.”

The controller should understand and govern how long operators and subprocessors retain personal data for controller-directed processing.

“Legal claims justify keeping the whole database forever.”

A concrete rights/claim purpose can justify targeted preservation, but indefinite blanket retention is difficult to reconcile with necessity and accountability.

15-Point LGPD Retention Review