Under the GDPR's storage limitation principle (Art. 5(1)(e)), how long may personal data be kept — and how does anonymization change the answer?

Personal data may be kept only as long as necessary for its stated purpose; truly anonymized data escapes this limit because it is no longer personal data.

Storage limitation means you can't hoard personal data "just in case." Retaining it past the point of necessity is a violation. This is a real operational headache for organizations that want long-term analytics.

The escape hatch: if data is irreversibly anonymized, it falls outside the scope of the GDPR entirely. No storage limit, no need for a legal basis to keep using it. That's a powerful incentive to anonymize properly — it converts a regulated liability into a freely retainable asset.

Tip: Anonymization is the only GDPR "off-switch." Pseudonymization is not — it only dials the risk down.

Go deeper:

• GDPR Recital 26 (gdpr-info.eu) — confirms anonymous data falls outside GDPR scope (the "off-switch").