Personal data must be stored for the shortest time possible. The period for which it should be retained must be determined by considering the reasons for retaining the data. A company must fix time limits to review or erase the data stored.