AI Document Processing Retention Policies: Why Storing Raw Uploads Past 90 Days Creates GDPR Exposure

An AI document processing retention policy sets the maximum time a system can keep the raw files users upload, along with derivative artefacts like OCR text, embeddings, prompts, and model outputs. Under GDPR Article 5(1)(e), that period has to be documented and justified, and it has to be enforced by real deletion, not by a checkbox on a policy page. Ninety days is the working ceiling most regulators treat as reasonable for operational retention of unstructured inputs, and anything beyond it needs a specific written purpose, or it becomes evidence in an enforcement file.

Why 90 days is the working ceiling for AI document processing retention policies

The 90-day figure is not a rule in the text of GDPR. It comes from what supervisory authorities have accepted in decisions and audits. Automated deletion pathways in most operational systems are expected to clear backups within roughly 90 days, and CCTV footage is typically held between 30 and 90 days unless it forms evidence in a formal proceeding. When your product ingests contracts, invoices, tax returns, or scanned IDs, the same benchmark applies. The regulator asks two questions: what is the specific purpose that requires retention, and when does that purpose expire.

The trap in AI document processing is that the raw upload is only one of several data artefacts you have to account for. A single PDF turns into text, chunks, vector embeddings, prompt logs, model outputs, and cache entries. Every one of those is personal data if the original file was. A retention policy that only names the PDF and forgets the derivatives fails Article 5(1)(e) even if you delete the source file on day 89.

Practical takeaway: Write a retention line for each artefact, not just the source file. The list should read: raw upload, extracted text, embeddings, prompt payload, model output, audit log. Each gets its own maximum period and a stated purpose.

The GDPR articles that put raw upload retention on the enforcement radar

Four articles do the work here, and every retention policy has to answer to all four.

Article 5(1)(c), data minimisation. The raw file is often more than the model needs. If your pipeline pulls three fields from a five-page contract, the other four pages are not lawful to keep past processing.
Article 5(1)(e), storage limitation. Retention has to be tied to a stated purpose and time-boxed. A general "for future model improvement" is not a stated purpose.
Article 17, right to erasure. When a user requests deletion, you have to prove the raw upload and every derivative were removed, including from backups and from any model fine-tuned on them.
Article 30, records of processing. Every retention period has to appear in the Record of Processing Activities with its justification. A missing entry is treated as evidence the policy does not exist.

The EDPB's Opinion 28/2024, published on 17 December 2024, added a specific point on AI systems: technical measures to prevent regurgitation of training data, and post-training methods to suppress or remove personal data, are part of the compliance picture, not optional extras. If your retention policy does not describe how you would honour a deletion request against a fine-tuned model, the policy is incomplete.

Practical takeaway: Map every artefact in the pipeline to at least one of the four articles above, and record the mapping in the RoPA. If an artefact cannot be justified against one of them, it should not exist.

What the enforcement record actually says about long retention

Named cases, not hypothetical ones, are the useful reference points.

PAP (De Particulier à Particulier), 100,000 euros, CNIL, 31 January 2024. The French classifieds site had a documented 5-year retention period for inactive user accounts, which the CNIL considered acceptable. Its inspection then found accounts held for more than 5 years, and some for more than 10. The fine was for the gap between the written policy and the operational reality. The point for AI systems is that "we delete after 90 days" is worth only what a database query proves.

Free Mobile, 42 million euros, CNIL. The French telecom operator was hit for keeping personal data past its stated purpose under a "just in case" retention pattern. The size of the fine tracks the scale of records kept, not the sensitivity of any one file. An AI document processor holding several years of raw uploads across a mid-market user base is sitting on the same risk profile.

Clearview AI, 30.5 million euros, Dutch DPA, decision dated 16 May 2024, announced September 2024. The regulator found no lawful basis under Article 6 for the biometric data collection, and specific failures under Article 9(1) for special category data. Retention was indefinite by design. The company was also warned of penalty payments up to 5.1 million euros if it did not stop. If your product processes scanned IDs or faces from uploaded documents, this is the decision to read.

OpenAI, 15 million euros, Italian Garante, decision published 2 November 2024. The Garante cited a failure to report a March 2023 breach and processing user data to train ChatGPT without a legal basis. Inadequate age verification was part of the finding too. The Court of Rome annulled the fine on 18 March 2026, but the reasoning that produced the fine, particularly on training data legal basis, has not been retracted by any regulator. Companies building on top of general models inherit some of this exposure through their processor contracts.

OpenAI preservation order, US District Court, 13 May 2025. Judge Ona T. Wang ordered OpenAI to preserve all output log data across Free, Plus, Pro, and Team ChatGPT tiers, including chats users had deleted. Enterprise and Education customers were exempt, along with API Zero Data Retention customers. OpenAI acknowledged the order might force GDPR breaches. The order was lifted in late September 2025. The lesson for any AI vendor is that a US litigation hold can freeze deletion on demand, and the GDPR does not care why you kept the data. The ZDR carve-out shows that a signed ZDR contract, not a policy statement, is what a court will honour.

CNIL's own 2024 numbers frame the pattern: 87 sanctions and 64 reprimands, alongside 180 compliance orders, with storage limitation cited repeatedly as an aggravating factor. LinkedIn (310 million euros) and Meta (251 million euros) took the largest 2024 penalties in Europe, and total GDPR fines reached about 5.65 billion euros by early 2025.

Practical takeaway: Read a named enforcement decision at least once a quarter. The rulings tell you what the regulators actually inspected, not what the guidance documents say they might.

A step by step retention framework for AI document processing

Six steps, in order, cover a compliant pipeline for uploaded documents.

Classify every artefact at ingest. Tag each file, extraction, embedding, prompt, and output with a category (personal data, special category, pseudonymised, anonymised) and a purpose ID from the RoPA. If the tag is missing, the artefact never gets written to permanent storage.
Set a maximum retention period per category. A defensible baseline for a document processing product: raw upload 30 days, extracted text 90 days, embeddings 12 months if pseudonymised, prompt logs 30 days, model outputs 90 days, audit logs 24 months. Adjust with a written reason for each.
Automate deletion. Every category needs a scheduled purge that leaves a receipt: what was deleted and when, together with which job ran it. The receipt is what you show an auditor.
Prove deletion covers backups. A 90-day operational deletion policy with 180-day backup retention is a 180-day retention policy in the eyes of a regulator. Align the two, or use crypto-shredding so that expired keys make the backups unreadable on schedule.
Honour erasure requests end to end. An Article 17 request has to touch the raw file, all derivatives, any model fine-tuned on the data, and any downstream processor. Document the workflow and run it as a drill once a quarter. Time each drill.
Record everything in the RoPA. Each artefact and its retention line has to appear in the Record of Processing Activities with a purpose and a legal basis, plus a review date. Missing entries are treated as missing controls.

Practical takeaway: Codify the six steps as a checklist in your engineering repo, not as a PDF in a compliance folder. A retention policy that lives in code is the one that survives contact with a busy team.

What to keep past 90 days, and how to justify it

Some artefacts genuinely need longer periods. The GDPR allows this if the purpose is specific and documented.

Financial and tax documents. National tax rules commonly require retention of 6 to 10 years for invoices and receipts, as well as payroll records. Store the derived structured data, for example an extracted line-item table, and drop the raw upload where the tax purpose can be satisfied without the source PDF.
Litigation holds. A specific legal claim, or a well-founded expectation of one, allows extended retention of the exact records at issue. It does not license a blanket freeze on the whole database. Write the scope of any hold in a memo signed by counsel.
Consent-based training data. If a user opts in to their documents being used to train a model, retention can extend for the duration of the model's lifetime, with clear withdrawal mechanics. The consent has to be granular, and the artefact has to be pseudonymised or fully anonymised where possible.
Audit and security logs. Fraud detection and incident response typically justify 12 to 24 months. Strip content from logs to metadata where possible, and set a firm ceiling.

Anything outside these categories should default to the 90-day ceiling. "We might want to look at it later" is the exact pattern the CNIL cited in the Free Mobile decision.

Practical takeaway: Build a two-tier storage model. Tier one holds raw uploads for up to 90 days with automatic purge. Tier two holds justified longer-retention artefacts, each tagged with the purpose that keeps it alive, and each on its own schedule.

The financial exposure of getting this wrong

GDPR fines cap at 20 million euros or 4% of global annual turnover, whichever is higher. That is the headline. The operational cost of a preservation order or an erasure backlog is often larger.

Three numbers to keep in front of the finance team:

30.5 million euros for indefinite retention without a legal basis (Clearview AI, Dutch DPA, 2024).
42 million euros for "just in case" retention past stated purposes (Free Mobile, CNIL).
100,000 euros for a documented policy that operational reality did not match (PAP, CNIL, January 2024).

The PAP figure is the one to internalise. A small company can be fined not for having no policy, but for having a good one that the database did not actually implement. That is the failure mode most AI document processors are exposed to today, because deletion is a background job that quietly fails while the marketing page still says "we delete after 90 days."

Practical takeaway: Add a monthly retention-drift check to your engineering rota. Query the database for the oldest record in each artefact category. If any is older than the policy allows, treat it as a live incident.

Getting this into your product

A retention policy for AI document processing has to be four things at once: written down in the RoPA, cited to a specific GDPR article, enforced by automated deletion with receipts, and consistent between the raw upload and every derivative artefact it produces. Ninety days is the working ceiling because it is what the regulators have accepted, and because the enforcement record shows anything past it becomes a question you have to answer. The companies fined in 2024 were not fined for wanting to keep data. They were fined for the gap between what their policy said and what their systems did.

ModelStack ships a GDPR AI Document Processing Retention Policy pack as part of the AI Workflow and SOP kit. It bundles the RoPA rows, an artefact classification table, a deletion receipt schema, and an Excel template for retention drift monitoring with a worked example set for a mid-market SaaS processor. It is a step by step spreadsheet model any operator can adapt on the day they download it, so the policy you ship matches the deletion job you run.