Data retention is important because one of the principles’ of the GDPR is data minimization, which means you should not be storing or handling data more than you need to or longer than you need to in order to perform the processing tasks that you have been assigned. For example, for us here at Aware, that means we will typically store data as a standard in line with fulfilling our contractual obligations for the duration of that contract. This is so we can continue to authenticate users after they have been enrolled in our system. For our customers, however, we have mechanisms in place so that our business clients can have users removed. If that user is no longer active with our business client, or if the data subject wants us to remove the information, we're able to make sure that information is properly removed.