Q: We keep every lead's full data forever 'just in case'. Our DPO is panicking. Why?

Q: We keep every lead's full data forever 'just in case'. Our DPO is panicking. Why?

A: Because GDPR has a storage-limitation principle: you may keep personal data only as long as you need it for the stated purpose. 'Forever, just in case' is the exact thing it forbids, and it turns every old record into liability.

The mistakes hiding here:

— No retention schedule, so rejected and expired leads pile up with names, emails, and IPs indefinitely.
— You keep raw IP and device data long after the fraud-check window that justified collecting it.
— You can't honor a deletion request because the same record is copied across five tools with no map.

Fix: set a retention period per data type tied to its purpose (a fraud-check IP might live 90 days; an active customer record longer). Auto-delete or anonymize past that. Keep a data map so a deletion request actually reaches every copy.

Short version: keeping everything forever violates storage limitation. Set per-purpose retention and delete on schedule.

Still stuck? Drop your case in the comments.