FORMAL ANSWER

Processing of personal data is permitted, among other things, only where the data subject has given consent, unless they request erasure of their data. That consent may also cover future processing, provided the purpose of processing does not change.

PRACTICAL ANSWER

A person's data may be processed for as long as the purpose of processing those data exists, or until that person requests that processing cease. A good example is data collected from potential future employees. If CVs are collected for recruitment purposes, the data should be deleted shortly after the recruitment process ends, unless the recruitment results may be challenged or the candidate has consented to processing of their data for future recruitment purposes.

MORE:

• We describe an example of data retention in the article: Data retention on email