How long should consent evidence be kept?

Consent evidence should be retained for the duration of the subscription relationship plus an extended period afterward to protect against delayed challenges or enforcement actions. During active subscription, you obviously need the consent record to justify ongoing processing. After unsubscription, the consent evidence remains relevant because complaints, regulatory inquiries, or legal claims can arise well after the relationship ends. A subscriber who unsubscribed in 2023 might file a complaint in 2026 about emails they received in 2022-you need the consent record from when they subscribed to demonstrate you had proper permission.

Most organizations retain consent evidence for 5-7 years after the subscription relationship ends, aligning with typical statute of limitations periods for civil claims and regulatory enforcement actions. Some jurisdictions may have longer limitation periods for certain types of claims, so research the specific requirements applicable to your operations. For GDPR compliance specifically, while the regulation doesn't specify a consent record retention period, the ability to demonstrate consent "at any time" suggests retention should extend well beyond the processing relationship.

Balance retention against data minimization principles. The consent record itself (timestamp, source, IP, terms agreed to) is minimal data that serves a legitimate compliance purpose-it's reasonable to retain this even when other subscriber data is deleted. However, don't use consent record retention as an excuse to keep extensive personal profiles or engagement data. The consent evidence is the proof of permission; other data should follow standard retention schedules. When the extended retention period expires, consent records can be deleted or anonymized unless there's an active legal matter requiring continued retention. Keep consent evidence long enough to answer any reasonable future question about whether permission was properly obtained.