Data retention concerns how long information is held. Under the storage limitation principle, personal data should not be kept longer than necessary for its purpose. The ICO recommends justified retention periods and review; there is no single duration for every kind of record. Source: ICO: storage limitation

Separate the purposes

In a travel business, assess an abandoned enquiry, a completed booking record and a marketing preference record separately. Use the actual purpose and applicable obligations to decide how each is handled. Do not assume that the end of a holiday means every related record should immediately be deleted.

Build a workable review

For each category, record the purpose, retention rule, review trigger and responsible person. Include the systems where copies are held so the policy can be applied in practice.

Test the process on a fictional record before applying it widely. Check how deletion, anonymisation or continued justified retention is recorded, because the team needs evidence of what it has done.

The ICO marks this guidance as under review following the Data (Use and Access) Act 2025. Use its current guidance and relevant professional advice when setting rules for your business. Source: ICO: storage limitation

Written and updated by Travelgenix. Sources checked on 16 October 2026. Worked examples and checklists are editorial illustrations and recommendations, not customer results.