Data Retention Policy Under GDPR

Retention should not be vague

Policies often say data is kept as long as necessary. That may be true, but it is rarely enough by itself.

Better text explains account data, billing records, support tickets, security logs, and backups separately.

Criteria can be acceptable

Exact day counts are not always practical. Criteria such as legal obligations, account status, dispute handling, and security needs can make the retention logic clearer.