The law is deliberately silent on exactly how long "necessary" is, as it cannot possibly define that for all uses of personal data in all circumstances. It's t

The law is deliberately silent on exactly how long "necessary" is, as it cannot possibly define that for all uses of personal data in all circumstances. It's trying to establish principles of good personal data governance, rather than being prescriptive about all uses of data. This does make it hard for legal teams to determine compliance I guess. But don't expect the EU to be more definite any time soon!