NIST Privacy Framework, Control-PCT.DM-P5

Do not keep personal data longer than necessary for the purpose it was collected for, and destroy or permanently delete it once that purpose has lapsed.

As a military, security, police, or intelligence body, limit consent-free processing of personal data for defense or public-security purposes to what your legally assigned mission strictly requires, keep the resulting files specific and classified by reliability, and cancel police-purpose data once it is no longer needed for the inquiry that justified it.

As a data-processing service provider acting for another party, use the personal data only for the purpose stated in the service contract, do not disclose it to others, and destroy it once the contracted service ends unless further engagements are reasonably expected, in which case you may keep it securely for up to two years.

Delete personal data once processing ends, unless retention is needed to comply with a legal or regulatory obligation, for research with anonymization where possible, for an authorized transfer, or for your own exclusive anonymized use.

Destroy documents containing personal information, or remove the means by which it can be associated with particular individuals, as soon as it is reasonable to assume that the purpose of collection is no longer served and retention is no longer necessary for legal or business purposes.

Delete Personal Data once the purpose it was collected for is satisfied, or hold it in a form that does not allow the Data Subject to be identified, and correct any error immediately on being told of it or becoming aware of it.

Destroy, delete or de-identify a record of personal information as soon as reasonably practicable after you are no longer authorised to retain it, in a manner that prevents its reconstruction.

Destroy personal data as soon as is reasonably practicable once the purpose for storing it has lapsed, in a manner that prevents its reconstruction in an intelligible form, and tell any data processor holding the data to do the same.

Keep personal data in a form which permits identification of data subjects for no longer than is necessary for the purposes for which it is processed, storage limitation; store it for longer only insofar as it will be processed solely for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1), subject to the technical and organizational measures the Regulation requires to safeguard the rights and freedoms of the data subject (Article 5(1), point (e)).

Destroy recordings as soon as they are no longer needed for the purpose of the surveillance and at the latest one year after the recording ends, subject to the exceptions in Section 17, paragraph 3 (Section 17, paragraph 3).

Destroy, delete or de-identify a record of personal information as soon as reasonably practicable after you are no longer authorised to retain it, in a manner that prevents its reconstruction.

Take reasonable measures to dispose, or arrange for the disposal, of records containing sensitive personally identifying information within its custody or control once the records are no longer to be retained, by shredding, erasing, or otherwise modifying the information to make it unreadable or undecipherable through any reasonable means consistent with industry standards.

When disposing of records containing personal information, take all reasonable measures necessary to protect against unauthorized access to or use of the records, including burning, pulverizing, or shredding paper documents and destroying or erasing electronic and nonpaper media so the personal information cannot practicably be read or reconstructed.

Adopt written policies and procedures relating to the adequate destruction and proper disposal of records containing personal information.

Redact that personal identifying information, or destroy the paper record or document, before discarding or disposing of it. This duty reaches paper records and documents only; it states no separate duty over electronic data.

Develop a written policy for the destruction or proper disposal of paper and electronic documents containing personal identifying information, and, once those documents are no longer needed, destroy or arrange for their destruction by shredding, erasing, or otherwise modifying the personal identifying information to make it unreadable or indecipherable.

Safeguard the data, computer files and documents containing that personal information from misuse by third parties, and destroy, erase or make them unreadable before disposal.

Take all reasonable measures to dispose, or arrange for the disposal, of customer records containing personal information within your custody or control once the records are no longer to be retained, by shredding, erasing, or otherwise modifying the personal information to make it unreadable or undecipherable through any means.

Shred the record, erase the personal information, modify the record to make the personal information unreadable, or take other action you reasonably believe will ensure that no unauthorized person will have access to the personal information, before discarding or disposing of a customer's record. Personal information here is personally identifiable data about a customer's medical condition, account or credit balance, information supplied on opening an account or applying for credit, or a tax return, combined with an identifier such as a Social Security number, driver identification number, or date of birth.

Take reasonable measures to protect against unauthorized access to or use of personal information in connection with or after its disposal.

Implement and monitor compliance with policies and procedures that require papers containing personal information to be burned, pulverized, recycled, or shredded, and electronic or other nonpaper media containing personal information to be destroyed or erased, so the information cannot practicably be read or reconstructed.

Dispose of paper records containing personal information by redacting, burning, pulverizing, or shredding them, and destroy or erase electronic media containing personal information, so the information cannot practicably be read or reconstructed.

Do not dispose of or abandon records or documents containing unencrypted and unredacted personal information of Indiana residents without shredding, incinerating, mutilating, erasing, or otherwise rendering the information illegible or unusable.

Do not retain identifying information after access is granted.

Do not retain identifying information.

Do not retain identifying information after access is granted.

Do not retain a user's identifying information after verification.

Do not retain, sell, or disseminate identifying information.

Do not retain any identifying information of the individual after access has been granted to the material; this binds a third party that performs the age verification as well.

The third party that performs the age verification must not retain any identifying information of the individual.

Do not retain identifying information after verification.

Do not retain identifying information after access is granted.

Do not retain identifying information after access is granted; this binds a third party performing verification as well.

Erase those recordings and traffic data at the latest at the end of the period during which the transaction can be challenged in court.

If you listen to or record communications and traffic data solely to monitor the quality of service in a call center, inform the people who work there beforehand of the possibility of listening and recording, the precise purpose and the retention period, and keep the data for one month at most.

Keep a recording no longer than the period in which it can be used to prove the commercial transaction (Article 247, paragraph 2).

Store the content data and related traffic data processed for these purposes, and the personal data generated through that processing, in a secure manner and solely for the purposes Article 3(1), point (h), lists once suspected online child sexual abuse has been identified, and no longer than strictly necessary for those purposes and in any event no longer than 12 months from the date of the identification of the suspected online child sexual abuse (Article 3(1), points (h) and (i)).

If your business monitors or records employees' marketing, opinion research or telephone solicitation calls (including order-taking, customer assistance and credit collection calls) under the one-party exemption, use it only for service quality control, training or internal research, never furnish or divulge the recordings to law enforcement or any third party, stop and destroy any recording of an unrelated call, give employees notice including prominent workplace signage, and provide personal-only lines that are not monitored.

Before you record information and related traffic data in lawful business practice to provide evidence of a commercial or other business transaction that may have legal consequences, inform the users of the recording and its purpose, and keep the recorded content and traffic data no longer than the period during which the transaction can be legally challenged.

If you record communications and the related traffic data in lawful professional practice to provide proof of a commercial transaction or other commercial communication, inform the parties beforehand that recordings may be made, why, and for how long they will be kept at most, and delete the recordings as soon as the purpose is achieved and in any event when the legal period for challenging the transaction expires.

If you record telephone marketing or customer service communications for training, quality control or monitoring, have one party's consent, use the recordings only for training or quality control, and destroy them within one year unless federal or State law requires otherwise.

Delete a recorded message immediately, and at the latest when the time in which the transaction can lawfully be challenged runs out (article 214, paragraph 7).

Inform both parties of a call or communication recording, its precise purposes, and its storage period before recording it for proof of a commercial transaction with a person in Belgium, and erase the data once the transaction can no longer be challenged in court.

Limit a call-centre quality-monitoring recording to a maximum one-month retention, with prior information to staff, under Act Article 10/1 paragraph 2.

Retain covered information only as long as reasonably necessary for the purpose it was collected, and keep a written data retention policy, available on request to a pupil, parent, guardian, education rights holder or K-12 personnel, stating the purposes, the retention purpose and a deletion timeframe (Section 22584(d)(4), (5)).

Delete personal data upon expiry of the five-year retention period of Article 77(3), without prejudice to retention periods for data collected for the purposes of other Union legal acts or national law complying with Regulation (EU) 2016/679 (Article 77(3)).

If you operate a health care facility that further processes health data it stores lawfully under GDPR Article 9(2)(h) or (i) for quality assurance, patient safety, research or statistics, pseudonymize the data, anonymize it as soon as the purpose allows, and delete it no later than 30 years after the further processing began (GDNG Section 6, paragraph 1).

An app that processes biometric data about an individual in Jordan, including a faceprint or voiceprint, must treat it as Sensitive Personal Data and obtain consent or rely on one of the Law's enumerated exceptions, and must not retain it beyond the processing purpose unless legislation specifies otherwise. Whether Jordan requires a heightened, explicit-consent standard specifically for biometric processing, beyond ordinary consent, is not confirmed.

An app that derives a faceprint, voiceprint, or other identity-linked biometric identifier from an individual in Saudi Arabia, for any purpose the purpose-based Sensitive Data definition would reach, must obtain the Data Subject's explicit consent before processing it, and must destroy it once the processing purpose is fulfilled or consent is withdrawn.

Honor a consumer's revocation of consent and destroy their biological sample within 30 days.

Do not retain a child's or teen's personal information longer than is reasonably necessary to fulfill a transaction or provide a service the child or teen requested, except as required for the safety or integrity of the service or specifically authorized by law.

Delete age determination data.

Terminate and permanently delete accounts that do not comply, including accounts your own analytics flag as likely belonging to a minor.

Collect only personal data that is adequate, relevant and necessary for age verification, and do not keep it longer than necessary for that process, consistently with the Personal Data Protection Act 2010.

Terminate and delete existing accounts of users under 14 by October 1, 2026.

Meet the expanded recordkeeping requirements and data retention limits.

Use proportionate age assurance, and limit how long you retain facial age estimation data.

Do not retain personal information collected to estimate age for any other purpose or longer than necessary to estimate age; age assurance must be proportionate to the risks and data practices of the service.

Process age-verification data only for that purpose and delete it once the purpose is fulfilled, subject to any statutory retention duty; protect the privacy and personal data of users, particularly children.

If you collect personal data to verify a user's age, use it for nothing else and delete it not later than 15 days after verifying the age.

Determine whether a user is a minor through age assurance, never self-declaration of age, using the methods the Attorney General's rules accept; where those rules are not in effect, use a reasonable method that guards against circumvention, minimizes the retention of the information collected, and is offered alongside at least one other method, one of which does not rely on government issued identification or lets the user stay anonymous to the operator.

An app that captures or stores a facial image, voiceprint (sound fragment and its acoustic parameters in the Act's own term), or other biometric identifier from a person in Azerbaijan is still bound by this Act's ordinary processing conditions, a lawful basis under Art. 9.6 and destruction under Art. 9.4 once the purpose is achieved, even though Azerbaijan does not treat biometric data as a heightened special category and imposes no biometric-specific consent, retention, or storage-technology duty.

Publish a written, publicly available policy establishing a retention schedule, and permanently destroy biometric identifiers and biometric information within 3 years of the individual's last interaction or when the collection purpose is satisfied, whichever occurs first.

Obtain written consent before processing a person's biometric data in Russia, never condition service on that consent, and retain any biometric sample your organization holds only up to 10 days before deleting it, since the durable copy of record lives in the state system.

Store and transmit a captured biometric identifier with reasonable care equal to or exceeding the protection given your other confidential information, and destroy it within a reasonable time, no later than the first anniversary of when the collection purpose expires.

If the authorisation is rejected, stop the linked use immediately and delete the personal data the use generated.

In the case of law enforcement, where seeking informed consent would prevent the AI system from being tested, make sure the testing itself and its outcome have no negative effect on the subjects and delete their personal data after the test is performed (Article 60(4), point (i)).

If the time limits are not observed or authorisation is refused, stop the use and delete the personal data, results and outputs, unless they are the body of the offence (art. 10, comma 2).

Interrupt, cease or block processing once notified to do so, cooperate with a CNPD request, and erase or destroy personal data once notified or once its retention period under Article 6 has elapsed, on pain of the penalty for qualified disobedience.

Do not retain nominative or encrypted personal data beyond the legal duration stated in the request for opinion or prior declaration for the processing, and do not disclose nominative data in a way that harms the person it concerns.

Do not wilfully collect, use or disclose personal health information in contravention of the Act or its regulations, and do not wilfully dispose of a record in contravention of the secure disposal duty.

Delete data processed for the contract, billing and technical purposes after the contract ends or is not concluded and after billing, and delete data processed for the other purpose once that purpose ends or the recipient so decides (Section 13/A, paragraph 7).

On a data subject's request, suppress and cancel their personal data from a social network, browser, or server, and, once your contractual relationship with them ends, suppress and cancel the personal data you collected during it.

Stop the use at once, and delete the personal data, results and outputs, if the conditions or time limits are not met or authorisation is refused (art. 8, comma 8).

The Department states that you are required to dispose of nonpublic information that is no longer necessary for business operations or other legitimate business purposes, including nonpublic information used for AI purposes, and says that, although not required until November 1, 2025, you should maintain and update data inventories and should identify all information systems that use or rely on AI and maintain an inventory of them.