The retention period is the length of time an organization keeps personal data before deleting or anonymizing it. The GDPR makes it a principle: data must not be kept longer than necessary for the purpose for which it was collected. This is the storage limitation principle, set out in Article 5.
Why set a period
Keeping every conversation "just in case" is tempting: it could help find a request, analyse questions or train the team. But every piece of data kept is data to protect, to find when someone requests access, to delete when someone requests erasure, and to expose in case of a leak. A period set in advance reduces these risks and forces you to ask what the data is really for.
The GDPR does not set a figure. It is up to the organization to determine and justify it, according to the use. It must also tell people the period, or the criteria used to determine it, in the information required by Article 13.
How to choose a period
The right period follows from how the data is actually used. A few questions help set it:
- What is this data used for? Answering a request, following up a customer, analysing frequent questions, defending yourself in a dispute
- How long does that use last? A question about opening hours is no longer useful after a few days; a quote request may remain useful for several months
- Does a legal obligation impose a period? Some commercial, accounting or tax documents must be kept for several years under Belgian law. A conversation that leads to an order may fall into this category
- Would anonymized data be enough? For statistics, aggregated figures with no name or e-mail often serve the same purpose
Several periods for several categories
In an AI assistant, not all data has the same use. It is reasonable to plan different periods:
| Category | Use | Period to consider |
|---|---|---|
| Routine conversations | Following up the request, review, improving answers | A few months to a year |
| Conversations about a sales request or a dispute | Following the file, evidence | The life of the file, then according to legal obligations |
| Contact memory | Personalizing future exchanges | Limited, renewed through use, with the contact's consent |
| Technical logs | Security, diagnostics | A few weeks to a few months |
| Anonymized statistics | Tracking activity | No limit, since they are no longer personal data |
These periods are orders of magnitude to think with, not legal recommendations. Each organization must adapt them to its activity and document them in its record of processing.
What the period means in practice
Setting a period is not enough: it has to actually apply.
- Deletion must be automatic. A scheduled purge is more reliable than a manual clean-up that gets forgotten
- Copies count too. A conversation exported to a spreadsheet, copied into an e-mail or a personal messaging app escapes the purge. Limit exports and store them where the same rules apply
- Processors must follow. The platform, the host and the model provider sometimes keep data according to their own periods. The data processing agreement must specify this
- Backups have their own cycle. Deleted data may survive for a while in a backup; that delay must be known and limited
- Deletion must be complete. Deleting a contact must delete their conversations, memory and attachments, not just their record
Retention period and erasure requests
The retention period is a ceiling, not an acquired right. A person can ask for their data to be erased before it expires, and the organization must comply unless an exception provided by the GDPR applies, such as a legal obligation to keep it. A tool that deletes all of a person's data in one operation makes it easier to respect this right.
Common mistakes
- Setting no period at all, thinking it can wait
- Choosing a very long period by default without being able to explain why
- Forgetting the assistant's memory, which keeps information about a person beyond the conversation
- Announcing a period in the privacy policy that the tool does not actually apply
Retention in KernChat
In KernChat, conversations are kept for 365 days by default, then deleted by a daily purge; the organization can change this period. Information kept by contact memory expires according to the assistant's policy. Deleting a contact or an organization also deletes its conversations and files. Messages sent to the model provider are used only to generate the answer.