Hacker News new | ask | show | jobs
by wolongong942 1176 days ago
Does GDPR remove the legal requirement for financial institutions to hold data for 7 yrs? if not then it's mostly irrelevant in this case.
2 comments

It depends on the data and it depends on the way that you store it. Nobody tells you to store all your data in plaintext for seven years in the live environment on an internet accessible service, there is simply no such requirement.

It also isn't necessarily a requirement that such permanent records are digital, this depends on the country.

No. On the contrary, GDPR explicitly allows data to be stored if retention is required for law, such as all financial data for 10+ years. However, there is absolutely no need to hold all this data "hot" in the production system and not in a "cold" archive without automated connection.
And GDPR forbids holding the data for longer than necessary, except in some very restricted cases (cf. art. 5(1)e.)
Thats the whole point of the initial comment. It is necessary to store some potential PII for long periods of time due to regulations from the same people that want you to get rid of all PII.