In short
The idea comes from the GDPR's storage limitation principle (Article 5(1)(e)): personal data may only be kept in a form that identifies people for as long as is necessary for the purposes it is processed for. The GDPR doesn't set one fixed period for every case here; how long is acceptable depends on the purpose. Separately, people can ask for their data to be erased under Article 17, for example when it is no longer needed or when they withdraw their consent.
This entry is general information, not legal advice.
Photo: Joey Huang / Unsplash
Example
Filmriss states on what happens to the photos: "90 days after the reveal, all of an event's photos are deleted automatically, the files as well as the records." Its FAQ puts it this way: "90 days after the reveal. After that they're deleted automatically, so download them before then." If you want pictures from the wedding for a photo book, download them from the gallery in time.
What to watch out for
- Know when the clock starts: with Filmriss, the period runs from the reveal, not from the upload.
- Save in time: once the period ends, the photos are gone from the server.
- A retention period isn't the same as a deletion request: the period applies automatically, while the right to erasure under Article 17 exists separately, where its conditions are met.
