Skip to main content
Skillrung

Purpose, legal basis, retention period: justifying every file you hold

Three decisions are taken before collection, never after. The purpose says what the data is for, in one sentence anyone can understand. The legal basis says what authorises the processing: the Regulation provides six of them, and only one applies per purpose. The retention period says when the file leaves everyday use, then when it disappears. Without those three written answers, a file grows, gets copied and becomes impossible to defend.

  • Written by Skillrung team
  • Review by a subject-matter expert under way
  • Updated on
Read the first 4 slides, freePlay the Discovery quiz, free

What is this course about?

Be able to say why you hold each file, on what legal ground, and until what date you keep it.

This is a core course: the material taught is the same for everyone, only the examples, the tools mentioned and the people you deal with change with your job. It has 3 sections, of which 1 section is followed by a quiz, and reads in 20-30 min. The legal framework cited is French law.

Nobody knows any more why this file exists

Open a shared folder at your structure: you will find a file that nobody can explain any more. Who created it, for what need, how long should it be kept? The answers left with its author. As long as nothing happens, that ignorance costs nothing. The day a request or an incident arrives, it is paid for all at once, and fast.

Key points

What a defensible file carries in writing

Four lines are enough, and they fit in an ordinary tracking spreadsheet.

  • The objective pursued, expressed without jargon
  • What authorises the collection, and nothing else
  • The information actually necessary for that objective
  • The moment the file leaves everyday use

What you will be able to do

  • Understand why every file must carry a reason, a basis and a deadline.
  • Link every collection to a purpose, a legal basis and a written retention period.
  • Go back over your own files and write down what is missing, without waiting for an inspection.

The first 4 slides, free

What you read with no account and no card. Here, the generic version; in the player, the examples take the vocabulary of your job.

Try it, before you even create an account

Choose a job: the passage below is rewritten straight away. Nothing is saved, and no extra content opens.

No job selected: the generic version is being shown.

Generic version
Open a shared folder at your structure: you will find a file that nobody can explain any more. Who created it, for what need, how long should it be kept? The answers left with its author. As long as nothing happens, that ignorance costs nothing. The day a request or an incident arrives, it is paid for all at once, and fast.

Real extract from the free slide “Nobody knows any more why this file exists” of this course.

  1. FreeSlide 1 of 13 · The file nobody can explain any more

    Nobody knows any more why this file exists

    Open a shared folder at your structure: you will find a file that nobody can explain any more. Who created it, for what need, how long should it be kept? The answers left with its author. As long as nothing happens, that ignorance costs nothing. The day a request or an incident arrives, it is paid for all at once, and fast.

  2. FreeSlide 2 of 13 · The file nobody can explain any more

    By the end, you will know how to decide

    • Write the purpose of a file in one sentence
    • Choose the basis that actually authorises that collection
    • Set a deadline and a point at which the file moves out
  3. FreeSlide 3 of 13 · The file nobody can explain any more

    What a defensible file carries in writing

    Four lines are enough, and they fit in an ordinary tracking spreadsheet.

    • The objective pursued, expressed without jargon
    • What authorises the collection, and nothing else
    • The information actually necessary for that objective
    • The moment the file leaves everyday use
  4. FreeSlide 4 of 13 · The file nobody can explain any more

    Where do you stand?

    One question before you read, with no score and no judgement. It places your current reflex on what authorises an everyday processing operation.

    1 short questions, marked immediately, inside the course.

These 4 slides can be read in the player, with no account and no card.

Read the first slide

Programme

3 sections, 13 slides and 4 quizzes in total. Each content section ends with a quiz that checks it has been learned.

  1. IntroductionFree

    The file nobody can explain any more

    Understand why every file must carry a reason, a basis and a deadline.

    • 4 slides
  2. SectionSubscribers

    Why you collect, and for how long

    Link every collection to a purpose, a legal basis and a written retention period.

    • 7 slides
    • Section quiz: 5 questions
  3. RecapSubscribers

    Your action plan

    Go back over your own files and write down what is missing, without waiting for an inspection.

    • 2 slides

9 slides are for subscribers

The first four slides of this course can be read without an account and without a bank card. From the fifth on, the €29.99/month incl. VAT subscription is needed. The Beginner level quiz, though, stays free: it measures your level without asking you for anything.

Subscribe, €29.99/month incl. VATPlay the Discovery quiz, free

How your level is measured

  • Beginner
    Questions drawn
    10
    Pass mark
    70 %
    Question bank
    ≥ 30
    Time limit
    20 min

    Free, no account and no subscription.

  • Intermediate
    Questions drawn
    12
    Pass mark
    75 %
    Question bank
    ≥ 36
    Time limit
    24 min

    Subscribers only, once the Beginner level is passed.

  • Expert
    Questions drawn
    15
    Pass mark
    80 %
    Question bank
    ≥ 45
    Time limit
    30 min

    Subscribers only, once the Intermediate level is passed.

The level shown for a course is the highest level you have passed, with your best score and its date. Questions are drawn at random on every attempt. Play the Beginner quiz for this course or read how we measure your level.

Which jobs is it for?

Common core: the examples change with your job, what is taught stays the same. It addresses all 58 jobs in the directory. See courses by job.

Frequently asked questions

Can you have people sign a general consent form to cover all your files?

No, and that single signature tends to weaken the organisation instead. Consent can be withdrawn at any time, whereas some processing has to continue: handling imposed by a legal text or provided for in the contract does not rest on the person's agreement. The work consists in linking each use to its own basis, then writing it down.

What should you do when no retention period seems obvious?

Write one down anyway, even if you have to correct it later: a rough period can be discussed, an absent one cannot be defended. First check whether your sector has guidelines published by the CNIL, the French data protection authority. If not, start from the real use of the file and from what you might be asked for later on.

Is archiving a file the same thing as deleting it?

No. A file first goes through everyday use, then through a phase where it is no longer used but is still needed, before possible long-term retention. Moving it from one phase to the next often comes down to an access right withdrawn, not to an erasure. And hiding a row from a display deletes nothing at all.

What can I read without a subscription?

The first four slides of every course are available without an account and without a subscription, as is the Beginner level quiz. From the fifth slide onwards, the €29.99/month incl. VAT subscription is required. Creating a free account unlocks no extra slide: it keeps your progress, your job and your results.

How is my level measured?

By three level quizzes: Beginner (10 questions, 70 % to pass), Intermediate (12 questions, 75 %) and Expert (15 questions, 80 %). The level shown is the highest level passed, with the best score obtained and its date.

Who writes and who reviews this course

  • Skillrung team

    Editorial team of skillrung.com

    The skillrung editorial team writes the courses from the publications of the French and European authorities: ANSSI, CNIL, Cybermalveillance.gouv.fr, Légifrance and EUR-Lex. Every figure is tied to its primary source, dated and verifiable from the course page. The team does not stand in for an expert reviewer: every course intended for publication is reviewed by a named professional of the field concerned, whose name and review date appear on the course page.

Artificial intelligence assisted the drafting. Editorial responsibility for the published text remains human.

Statements with regulatory scope verified on .

Sources

Every figure stated in this course points to a primary source, dated and verifiable.

  1. Règlement (UE) 2016/679 du Parlement européen et du Conseil du 27 avril 2016 (RGPD)

    EUR-Lex, Union européenne, published on

  2. Le registre des activités de traitement

    CNIL, published on

  3. Les bases légales d'un traitement de données personnelles

    CNIL, published on

  4. Les durées de conservation des données

    CNIL, published on

  5. Professionnels : comment répondre à une demande de droit d'accès ?

    CNIL, published on

  6. Travailler avec un sous-traitant

    CNIL, published on

  7. Notifier une violation de données personnelles

    CNIL, published on

  8. Transférer des données hors de l'Union européenne

    CNIL, published on

What Skillrung is not

  • Skillrung is not a French training body certified under the Qualiopi scheme.
  • As things stand, our content is not eligible for the French CPF, OPCO, DPC or FAF funding schemes.
  • A Skillrung certificate of completion is not a diploma, not a professional title and not a qualification registered in any national register. It records a result obtained in an unsupervised online assessment, on a given date.
  • Taking a Skillrung course does not make your organisation compliant and does not replace the obligations that fall on your employer or on you.
  • Our content is educational. It is neither legal advice, nor medical advice, nor a security audit.
  • For a self-employed professional or a company, the subscription is a deductible business expense : confirm this with your accountant.

Same topic

The other compliance & personal data courses

See the whole catalogueOur method

Keep going on Skillrung

The pages that follow on from this one, in the recommended order.