How long should campaign, visitor and customer data be kept? Keeping it forever increases risk and breaches the storage-limitation principle; deleting it too early prevents analysis and obligations. Setting periods by type of data, and complying with them, is a simple task to do and a hard one to recover if forgotten.
The essentials in a definition
Data retention defines how long campaign and customer data are kept. The storage-limitation principle of the GDPR requires keeping data only as long as necessary for the purpose. Tools such as GA4 have configurable retention periods, and the CNPD gathers guidance. Defining periods by data type and deleting what no longer serves reduces risk and costs.
The principle
Personal data should only be kept for as long as necessary for the purpose that justified its collection. When the purpose ends, data should be deleted or anonymised, unless there is a legal obligation to retain. This applies to analytics tools, CRM, ad lists and backups.
Each tool has its own retention settings.
Which periods to set
Consider categories: browsing and analytics data (shorter periods), unconverted leads, active and inactive customers, billing data (legal obligations), consent records (while processing lasts and as proof), audience lists. Set reasonable periods for each, and justify them. Check with legal support and whoever handles data protection.
Some platforms limit retention time themselves.
Setting retention periods
- List data categories and tools
- Set periods with justification
- Configure deletion in the tools
- Audit and review periodically
Applying in practice
Configure retention in the tools (analytics, CRM, email). Create routines to delete or anonymise. Check lists uploaded to ad platforms, which also need updating. Export aggregated data you need to keep for historical analysis, without personal data.
Record the policy in a document.
Data that is not kept cannot be lost, stolen or forgotten to delete.
Verify and review
Run periodic audits: what data exists, where, for how long, on what basis. Delete what has passed its period. Review periods when legislation, purposes or tools change. Train the team. Respond to erasure requests within legal deadlines.
Less data kept means less risk.
Decision table
| Data type | Purpose | Retention (idea) |
|---|---|---|
| Analytics and event data | Behaviour analysis | The useful minimum, with a defined period |
| Customer lists for ads | Marketing with consent | While there is consent and relationship |
| Unconverted leads | Commercial contact | Defined period; delete afterwards |
| Consent records | Proof of compliance | As long as needed for proof |
Common mistakes to avoid
- Keeping everything “just in case”. It contradicts minimisation and raises risk.
- Default periods. Choose them by purpose.
- Not really deleting. Ensure deletion in systems and at suppliers.
How to measure the result
Track the volume of personal data kept and the percentage subject to a retention period, and verify deletions.
Limits and exceptions
Appropriate periods depend on purpose, law and context, and this content is informational, not legal advice. Some obligations (tax, contractual) require longer retention. Avoid arbitrary periods and consult legal support for specific cases; review the table annually.
Illustrative example
Illustrative example: a company defines a retention table: analytics events for 14 months, unconverted leads for 12 months and ad lists reviewed every month. It configures tools accordingly and schedules automatic deletions. The company reduces the amount of personal data kept and demonstrates the process in audits.
In practice: checkpoints
Set retention periods by type of data based on purpose and law, and delete or anonymise when they expire. Keep a table of data, purpose, period and owner, and automate deletion where possible. Review the table yearly and when you change tools, and make sure suppliers apply the same periods to data they hold for you.
Frequently asked questions
How long should I keep analytics data?
The minimum necessary. Set a period and adjust the tool’s settings.
What about lists on ad platforms?
Update them regularly, removing those who should no longer be there.
Who decides the periods?
The company, with legal and data-protection support.
How long can I keep data?
As long as needed for the purpose and the law; define periods by type and document the justification.
Do I need to delete at suppliers?
Yes, where applicable; ensure agreements provide for deletion and verify it.
Define retention periods by data type, configure tools, delete what no longer serves and document, in compliance with the storage-limitation principle.
Sources and recommended reading
- General Data Protection Regulation (GDPR)
- Analytics Help: data retention
- Portuguese Data Protection Authority (CNPD)
Last editorial review: October 2026. Informational content; always confirm current conditions in the official sources before deciding.