DAC8 Data Retention Requirements

How long must CASPs retain DAC8-related data? This question involves the intersection of DAC8's reporting needs, national transposition requirements, and GDPR's storage limitation principle.

Retention Under DAC8

DAC8 itself does not specify a uniform retention period. Instead, it requires Member States to establish retention periods in their national transposition legislation. These periods typically range from five to ten years after the end of the reporting period.

During the retention period, CASPs must maintain all data necessary to demonstrate the accuracy and completeness of their reports, including user identification documents, self-certifications and TIN records, transaction records used to compile reports, copies of submitted XML reports, and documentation of due diligence procedures performed.

GDPR Storage Limitation

GDPR's storage limitation principle (Article 5(1)(e)) requires that personal data be kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the data is processed. For DAC8, the retention period established by national law defines the period of necessity.

Once the retention period expires, CASPs must delete or anonymize the data. Continued retention without a legal basis would constitute a GDPR violation.

Practical Implementation

CASPs should implement automated retention management that flags data approaching the end of its retention period, generates deletion schedules, verifies that no other legal basis (such as litigation holds) requires continued retention, and documents the deletion process for audit purposes.

Conclusion

DAC8 data retention is governed by national transposition legislation, typically five to ten years. CASPs must implement systematic retention management that complies with both DAC8's record-keeping requirements and GDPR's storage limitation principle.