How long may personal data be kept?
By Advisorn · updated on 25 October 2026 · Art. 6 para. 4, 12 FADP, Art. 958f CO, Art. 5 para. 1 let. e GDPR
In short
The FADP sets no periods: data must be destroyed or anonymised as soon as it is no longer needed for the purpose of the processing (Art. 6 para. 4 FADP). Other laws, however, require some of it to be kept, for example accounting records and vouchers for ten years (Art. 958f CO). For each activity of the record the retention period, or the criteria for determining it, must be stated (Art. 12 para. 2 let. e FADP).
How to set the periods
- start from the purpose: what you need the data for, and until when;
- add the statutory periods (accounting, salaries, social insurance) and the limitation periods of claims you might have to assert or defend;
- write the periods in a retention policy and in the record;
- decide who deletes and when, in backups and at vendors too.
Common examples
- accounting and vouchers, invoices included: ten years (Art. 958f CO);
- unsuccessful job applications: until the end of the selection, plus a few months to defend against a claim, unless there is consent to keep them longer;
- video surveillance footage: a few days, unless there is an incident to clarify;
- contact details of people who unsubscribed from the newsletter: only what is needed not to write to them again.
Related questions
Useful templates
General information, not advice on your case: for your case the text of the law prevails. For a question about your case there is Advisorn's consulting.