Personal data may only be stored as long as it is necessary taking into consideration the purpose of the processing. When the purpose of the processing is completed, the main rule is that the data should be de-identified or destroyed.