Blog post overview and metadata
Author, publish date, read time, and category
GDPR Data Retention for UK Web Applications: What to Delete, and When
Reviewed by: ARS Developer Team | Updated: 30 Sep 2026 | UK Focus: Buyer-intent SEO, web delivery, and measurable conversion growth.
Quick Summary
UK GDPR requires personal data to be kept no longer than necessary. Here is how to turn that into a retention schedule your web application can actually enforce.
In This Guide
Why This Article Is Trustworthy
- Reviewed by the ARS Developer editorial team for UK business relevance.
- Structured around buyer-intent SEO, technical delivery, and measurable conversion outcomes.
- Connected to related service pages, pricing guidance, and supporting articles for stronger topic depth.
Quick Answer
UK GDPR does not set retention periods for you. It requires that you set them, justify them, write them down, and then actually apply them — which is where most web applications fail, because deletion is a feature nobody asks for and every system quietly hoards data by default.
Start with the data you forgot you were keeping
The customer records are the part everyone thinks about. What accumulates unnoticed is everything around them: every enquiry form submission sitting in a database table since launch, abandoned registrations, email logs containing names and addresses, exported CSVs in a downloads folder, and application logs that captured request bodies during a debugging session two years ago.
Before writing a policy, inventory what personal data your application actually holds and where. A retention schedule that covers the customers table while five years of form submissions sit in another is a document rather than a control.
Choose periods you can defend
The test is necessity: how long do you genuinely need this to do the thing the person gave it to you for, or to meet another legal duty. An enquiry that never converted does not need keeping for six years. Records supporting a transaction generally do, because HMRC expects business records to be available for six years from the end of the accounting period they relate to.
Write the reasoning next to each period. "Enquiries: 24 months, because that is the longest realistic sales cycle for our services" is defensible. A period with no stated reason is the first thing an ICO enquiry asks about.
Build deletion in, because manual deletion does not happen
A retention policy applied by someone remembering to run a query is a policy that lapses the first busy month. It belongs in a scheduled job that runs nightly, deletes what has passed its period, and writes a line recording how many rows it removed.
Two details matter. Soft deletes are not deletion — a row flagged as deleted is still personal data, so the job has to remove it properly once any grace period has passed. And test the job against a copy first: a retention script with an off-by-one in its date arithmetic deletes live records, and nobody notices until a customer asks about their order.
Backups are the part that catches people out
Deleting a record from the live database does not remove it from last night's backup, or from the six months of backups behind it. Strictly, that data still exists and is still yours to account for.
The accepted position is that backups are put beyond use rather than individually edited: you document that deleted data persists in backups, that backups are encrypted and access-controlled, that they expire on a defined cycle, and that a restore would have the retention job re-applied. What matters is that backup retention is deliberate and written down rather than infinite by accident.
Frequently Asked Questions
Does UK GDPR state how long I can keep data?
No. It requires you to decide a period that is no longer than necessary for your purpose, record your reasoning, and apply it consistently.
Do I have to delete data from backups?
Not individually. The usual approach is to document that backups expire on a defined cycle, are encrypted and access-controlled, and that retention rules are re-applied after any restore.
What about anonymised data?
Genuinely anonymised data falls outside UK GDPR, but the bar is high — if the individual can be re-identified by combining it with anything else you hold, it is still personal data.
How long should contact form submissions be kept?
There is no fixed answer, but a period tied to your sales cycle, commonly one to two years, is straightforward to justify. The important thing is choosing it deliberately.
Next Step
If your application has no retention job and nobody is sure what is in the older tables, an inventory is the sensible first step. Get in touch and we can scope one.
Next Step Resources
Move from research into action with the most relevant service, proof, pricing, and project planning pages for this topic.
Tags:
Leave a Comment
Ask a practical question, share a project insight, or add a useful note. Every comment is reviewed before it appears publicly.