Task 5 — Retention Periods & Transfers

How long do you keep it — and does it leave the country or the group?

Complete each processing activity with its retention period and its transfers. They are the basis for the retention schedule in Workshop 6 and the transfer checks in Workshop 10.

What to document

Retention period: a fixed period or the criteria to determine it, and the event that starts it (e.g. end of contract)
Transfers to other countries: the recipient countries, including cloud services and support teams with access from abroad
Transfers within the group: e.g. a shared HR or CRM system run by the parent company

In ResGuard: transfers are recorded in Supplier Management, the module for third parties and vendors. Create each recipient there, such as a vendor, a group company or another third party, with its country, and link it to the processing activity in the RoPA.

Transfers in your jurisdiction

Malta

Within the EU/EEA, data flow freely. Transfers to other countries need an adequacy decision of the European Commission (e.g. UK, Switzerland, Japan, or US companies certified under the EU-US Data Privacy Framework), appropriate safeguards such as standard contractual clauses (SCCs) or binding corporate rules (Art. 46 GDPR), or, for occasional transfers only, an exception such as explicit consent (Art. 49 GDPR). With SCCs, a transfer impact assessment is expected. Processors need a contract under Art. 28 GDPR.

Example: retention and transfers

Processing activity	Retention period	Transfers
Payroll	Period required by tax and social security law, from the end of the year	Payroll provider in the same country
Recruitment	A few months after the position is filled, longer only with the applicant's consent	None
Newsletter	Until consent is withdrawn	E-mail marketing service hosted abroad
CRM	Duration of the customer relationship plus statutory periods	Group CRM operated by the parent company

The exact periods depend on your tax, accounting and employment laws — record the law next to each period.