GDPR attendance lists – how long should training documentation be kept?

ANSWER

The retention period is not set out in legislation and depends on the controller's decision. If training is conducted only once a year, longer retention of documentation — e.g. 3–5 years — seems reasonable; if training is frequent, the period may be much shorter, as it will be easier to demonstrate the cyclical nature of the measures taken.