GDPR Data Retention Deadline Calculator

Are these default retention periods legally required?

No, they are commonly-cited industry benchmarks, not legal requirements. GDPR itself does not specify fixed retention periods, it requires you to justify whatever period you choose against a legitimate purpose (contract, legal obligation, legitimate interest) and delete data once that purpose no longer applies. Financial record retention is often set by separate tax law, not GDPR, and varies by jurisdiction, always confirm your specific obligations with legal counsel rather than relying on generic defaults.

What happens if a deletion deadline has already passed?

Under GDPR, holding personal data beyond its justified retention period without a valid ongoing purpose is itself a compliance gap. An overdue deadline should trigger immediate deletion (or an updated justification if a legitimate purpose to retain longer still exists) rather than being left indefinitely.

Does this tool actually delete any data?

No, this is a date-calculation tool only. It tells you when deletion is due; the actual deletion still needs to happen in your systems, whether manually or through an automated retention-enforcement workflow.

Can I automate the actual deletion once I know the deadline?

Yes, this is a common n8n use case, a scheduled workflow that queries records approaching or past their retention deadline and triggers deletion or an internal review task automatically, rather than relying on someone remembering to check a spreadsheet.

Does this apply outside the EU?

The specific "GDPR" framing is EU-specific, but the underlying pattern (data collected on a date, retained for a defined period, then deleted) applies under most global privacy frameworks (CCPA, LGPD, and similar), only the specific required periods and legal justification differ by jurisdiction.