A retention period must be defined for each type of data and justified by the needs of the processing and/or legal constraints.
A distinction must therefore be made between current data and archived data, access to which will be restricted to those concerned. A deletion mechanism must be implemented to archive current data or purge archived data at the end of its retention period.
Functional traces will also have to be purged, as will technical logs which cannot be kept indefinitely.