# Purpose, legal basis, retention period: justifying every file you hold URL : https://skillrung.com/en/courses/data-compliance/purpose-legal-basis-retention Topic: Compliance & personal data · Duration: 20-30 min · Updated on 2026-09-15 ## In brief Three decisions are taken before collection, never after. The purpose says what the data is for, in one sentence anyone can understand. The legal basis says what authorises the processing: the Regulation provides six of them, and only one applies per purpose. The retention period says when the file leaves everyday use, then when it disappears. Without those three written answers, a file grows, gets copied and becomes impossible to defend. ## Programme - 1. The file nobody can explain any more : Understand why every file must carry a reason, a basis and a deadline - 2. Why you collect, and for how long : Link every collection to a purpose, a legal basis and a written retention period - 3. Your action plan : Go back over your own files and write down what is missing, without waiting for an inspection 1 content sections, each with its quiz. Three level quizzes: Beginner, Intermediate, Expert. ## Free preview (first 4 slides) ### 1. Nobody knows any more why this file exists Open a shared folder at your structure: you will find a file that nobody can explain any more. Who created it, for what need, how long should it be kept? The answers left with its author. As long as nothing happens, that ignorance costs nothing. The day a request or an incident arrives, it is paid for all at once, and fast. ### 2. By the end, you will know how to decide - Write the purpose of a file in one sentence - Choose the basis that actually authorises that collection - Set a deadline and a point at which the file moves out ### 3. What a defensible file carries in writing Four lines are enough, and they fit in an ordinary tracking spreadsheet. - The objective pursued, expressed without jargon - What authorises the collection, and nothing else - The information actually necessary for that objective - The moment the file leaves everyday use ### 4. Where do you stand? One question before you read, with no score and no judgement. It places your current reflex on what authorises an everyday processing operation. _Self-assessment of 1 questions in the player._ ## Access The first four slides of every course and the Beginner-level quiz are free, with no account. From the fifth slide onwards a subscription is required: €29.99/month incl. VAT, no commitment, cancellable online. skillrung is not a French training body certified under the Qualiopi scheme; its content is not eligible for the French CPF, OPCO or DPC schemes. ## Frequently asked questions ### Can you have people sign a general consent form to cover all your files? No, and that single signature tends to weaken the organisation instead. Consent can be withdrawn at any time, whereas some processing has to continue: handling imposed by a legal text or provided for in the contract does not rest on the person's agreement. The work consists in linking each use to its own basis, then writing it down. ### What should you do when no retention period seems obvious? Write one down anyway, even if you have to correct it later: a rough period can be discussed, an absent one cannot be defended. First check whether your sector has guidelines published by the CNIL, the French data protection authority. If not, start from the real use of the file and from what you might be asked for later on. ### Is archiving a file the same thing as deleting it? No. A file first goes through everyday use, then through a phase where it is no longer used but is still needed, before possible long-term retention. Moving it from one phase to the next often comes down to an access right withdrawn, not to an erasure. And hiding a row from a display deletes nothing at all. ## Sources - Règlement (UE) 2016/679 du Parlement européen et du Conseil du 27 avril 2016 (RGPD) : EUR-Lex, Union européenne, 2016-04-27, https://eur-lex.europa.eu/legal-content/FR/TXT/?uri=CELEX%3A32016R0679 - Le registre des activités de traitement : CNIL, 2026-09-11, https://www.cnil.fr/fr/RGPD-le-registre-des-activites-de-traitement - Les bases légales d'un traitement de données personnelles : CNIL, 2026-09-11, https://www.cnil.fr/fr/les-bases-legales - Les durées de conservation des données : CNIL, 2026-09-11, https://www.cnil.fr/fr/passer-laction/les-durees-de-conservation-des-donnees - Professionnels : comment répondre à une demande de droit d'accès ? : CNIL, 2026-09-11, https://www.cnil.fr/fr/repondre-une-demande-de-droit-dacces - Travailler avec un sous-traitant : CNIL, 2026-09-11, https://www.cnil.fr/fr/sous-traitant - Notifier une violation de données personnelles : CNIL, 2026-09-11, https://www.cnil.fr/fr/services-en-ligne/notifier-une-violation-de-donnees-personnelles - Transférer des données hors de l'Union européenne : CNIL, 2026-09-11, https://www.cnil.fr/fr/les-outils-de-la-conformite/transferer-des-donnees-hors-de-lue