Pro Tier Module

GDPR Data Retention Period Calculator

Exact GDPR storage-limitation deadlines from a cited, jurisdiction-confirmed period - no EU-wide guess.

See it run - a worked example, 100% in this browser tab

The problem

Data protection officers and privacy counsel must compute deletion deadlines under GDPR Art 5(1)(e) where the concrete period comes from member-state tax, employment, and limitation law, not a single EU number. Assuming one wrong period silently mis-dates an entire erasure schedule.

The local-first solution

This plugin computes retention-end and deletion-deadline dates by exact UTC calendar arithmetic over a retention period you confirm as a dated, jurisdiction-indexed input, citing the member-state statute it used and running entirely client-side with no personal data uploaded.

What it does

Retention-end date computed as trigger date plus a confirmed, cited member-state period

Deletion deadline as retention-end plus an optional grace/disposal window

Per-jurisdiction, per-category default periods each citing the controlling statute (tax, commercial, employment law)

Consent-withdrawn outcome: retention ends immediately at the withdrawal date (Art 7(3), Art 17(1)(b))

Open-ended 'until withdrawn / no fixed period' handling that returns a review cadence rather than inventing a number

Exact whole-day and true month/year calendar adds with month-end clamping and no timezone drift

Honest scope

Not legal advice: Art 5(1)(e) fixes the principle while the concrete number is set by member-state law and the controller's documented schedule, which you confirm per category. The calendar arithmetic, consent-withdrawal, and open-ended handling are exact; every default period is a cited member-state figure you confirm rather than an EU-wide constant, and legal-hold suspension, sector overlays, cross-border transfers, the controller-vs-processor split, and the necessity judgement itself are flagged, not computed.

Authorities cited

GDPR (Regulation (EU) 2016/679) Art 5(1)(e) - Storage limitation: personal data kept in a form permitting identification of data subjects for no longer than is necessary for the purposes for which they are processed.
GDPR Art 6(1)(a)-(f) - Lawfulness of processing: the six legal bases (consent, contract, legal obligation, vital interests, public task, legitimate interests).
GDPR Art 7(3) - The data subject has the right to withdraw consent at any time; withdrawal must be as easy as giving consent and does not affect prior lawful processing.
GDPR Art 17(1)(a)-(b) - Right to erasure ("right to be forgotten"): erasure where data are no longer necessary, or where consent is withdrawn and there is no other legal ground for the processing.
Germany - Abgabenordnung (AO) sec. 147(3): 10-year retention of books, records, inventories, balance sheets and booking documents; Handelsgesetzbuch (HGB) sec. 257(4): 10 years for commercial books / 6 years for business letters.
France - Code de commerce art. L123-22 (10-year accounting books); Livre des procedures fiscales art. L102B (6-year tax records); Code civil art. 2224 (5-year general civil prescription); Code du travail art. L3243-4 (payslip copy retention).
United Kingdom (UK-GDPR + DPA 2018) - Limitation Act 1980 s.5 (6-year simple-contract limitation) and s.8 (12-year limitation for a deed); Companies Act 2006 s.388 / HMRC record-keeping duties.
Ireland - Taxes Consolidation Act 1997 s.886 (6-year tax-record retention); Statute of Limitations 1957 s.11 (6-year contract/tort limitation).
EDPB / Art 29 WP guidance on storage limitation and erasure - the period must derive from a documented purpose-necessity assessment and a written retention schedule, not a generic constant.

Calculate a deletion deadline

Compute the deadline in your browser and route the dated schedule into a Sandbox workspace, a Worklog case file, or a Gate client portal. Nothing is uploaded to anyone's cloud.

Try it live inside GDBS Open a free Standard account

GDBS by VaultSync Solutions Inc. - Verifiable Computation. gdbs.getvaultsync.com