A notice states retention only as "we keep personal data as long as needed" with no period or determination criteria. What should be corrected?
Select an answer to reveal the explanation.
Short Explanation
"As long as needed" without more is a shrug. Tell people the period or the yardstick you use—contract end plus X years, end of account, legal hold rules—so storage limitation is real, not vibes.
Full Explanation
Articles 13(2)(a) and 14(2)(a) require controllers to inform data subjects of the period for which personal data will be stored, or if that is not possible, the criteria used to determine that period. Open-ended "as long as needed" language without criteria fails that duty. Indefinite retention promises, fine amounts, or omitting retention for legitimate-interests processing are not compliant alternatives.