GDPR data retention is the obligation that sounds like a number and is not one. The regulation names no periods. It requires that personal data is kept in a form permitting identification no longer than is necessary for the purposes it was collected for, which means the period is yours to set, to justify and, harder, to enforce against systems that were built to keep everything.
Set the period per purpose, not per system
Retention attaches to why you hold something. An order record is kept because of tax and accounting obligations, and those set a floor in years. A marketing contact is kept while they want to hear from you, which has no fixed end and needs a rule about inactivity. A support ticket is kept while it might be reopened or complained about. Three purposes, three periods, often all in one CRM, which is why setting periods per system produces either an absurdly long one or a deletion that breaks the books.
Write down the reason beside the number
The number on its own is unfalsifiable. Seven years because of the tax rule that says so is an argument; seven years because we picked it is a habit. Keeping the reason beside the period also tells you when the period should change, and it is what turns the retention statement in your privacy notice from a claim into a description. Where you genuinely cannot state a period, state the criteria, which the regulation expressly allows.
Backups are where the policy meets reality
Deleting from live systems is quick and expiring from backups is not. The workable position, and the one most organizations take, is that deletion happens promptly in live systems and backup copies are put beyond use and expire on the backup cycle, with no restoration of deleted records into live. Say that plainly in the notice rather than promising immediate deletion everywhere, because a promise your infrastructure cannot keep is a worse position than an accurate description.
The data you already have
Most small companies start this exercise holding years of records with no policy behind them. The practical order is: set the periods, apply them going forward, then run one backlog pass per system with the periods you have just written. Do the mailing list first, because an unengaged list is the clearest case and shrinking it usually improves deliverability at the same time. Record what you deleted and when, because the deletion is also evidence.
Questions people ask about GDPR data retention
Is there a standard retention period?
No. The regulation sets none and any table claiming to is somebody's opinion, except where another law sets a floor, as tax and employment rules often do.
Does anonymising count as deleting?
Genuinely anonymised data falls outside the regulation, but the bar is that the person can no longer be identified by anyone using reasonably available means. Removing a name from a row that still carries an email and an order history does not reach it.
What about data in a vendor's system?
Your processing agreement should require deletion or return at the end of the service, and your retention rule has to reach into the vendors as well as your own database.