GDPR Fact Check: "Delete After 5 Years" Is Wrong; "4% of Turnover" Is Incomplete
Interpretation: both claims are judged against Regulation (EU) 2016/679 as published in the Official Journal on 4 May 2016, with the jurisdiction context set as EU, 2024. I did not check for later amendments or corrigenda. Verdicts are recommendations for you to confirm, not legal advice.
| # | Claim as stated | Verdict | Original source | Evidence for | Evidence against | Context or caveats | Corrected wording |
|---|---|---|---|---|---|---|---|
| 1 | EU companies must delete customer data after 5 years under GDPR | wrong | GDPR, Art. 5(1)(e), Recital 39, Art. 17 (OJ L 119, 4 May 2016) | None found. A text search found five-year periods only for certification accreditation (Art. 43(4), a maximum) and the EDPB Chair and deputy chairs' term (Art. 74(2)), not customer data. | Art. 5(1)(e) requires data to be kept for no longer than is necessary for the purposes for which the personal data are processed. It sets no fixed number of years (archiving, research and statistics purposes allow longer storage with safeguards). | Period depends on purpose and on other laws. Art. 17(3) lets a legal obligation override erasure. Sector or national laws may set their own periods (not researched here). | "GDPR requires companies to keep personal data no longer than necessary for their stated purposes, and to set their own retention or review periods. It sets no fixed period such as 5 years." |
| 2 | GDPR fines can reach 4% of global annual turnover | supported | GDPR, Art. 83(5)–(6) (OJ L 119, 4 May 2016) | Art. 83(5) allows fines up to 20 000 000 EUR, or in the case of an undertaking, up to 4 % of the total worldwide annual turnover of the preceding financial year, whichever is higher. | The 4% ceiling applies only to the more serious infringements. Art. 83(4) sets a lower tier of 10 000 000 EUR or 2 %. | Missing qualifier: "whichever is higher" means the €20 million figure applies when it exceeds 4% of turnover, as it will for smaller firms. 4% is a maximum, not a standard fine. | "For the most serious infringements, GDPR fines can reach up to €20 million or 4% of total worldwide annual turnover of the preceding financial year, whichever is higher. Lesser infringements carry up to €10 million or 2%." |
Summary
Verdict count: 1 wrong, 1 supported (needs a qualifier added), 0 outdated, 0 unverified. The highest-risk error is claim 1. A company that believed in a universal five-year rule could delete data it must lawfully keep, or keep data longer than its purpose justifies.
Notes
- Claim 1 (wrong): Recital 39 asks controllers to set time limits for erasure or periodic review, which confirms that the controller sets the period. Art. 83(5)(a) lists Art. 5, so (my inference) storage-limitation breaches sit in the higher fine tier. I did not locate EDPB or national DPA guidance on specific retention periods, so the claim that no regulator sets a blanket five-year rule rests on the statute text alone. A search of the GDPR text found no such rule.
- Claim 2 (qualifier): As an enforcement example, the Irish DPC's Meta decision of 12 May 2023 (announced 22 May 2023) imposed an administrative fine of €1.2 billion for a transfer infringement. I did not verify Meta's turnover, so I make no claim about how close this was to the cap. On 21 September 2026 the EDPB adopted guidelines on applying fines alongside other corrective powers, in public consultation until 13 November 2026. The EDPB says they complement its earlier guidelines on calculating administrative fines. The statutory ceiling in Art. 83 is unchanged by this.
Do next
- Replace claim 1 with the corrected wording; do not publish it as written.
- Add "whichever is higher" and the 2% lower tier to claim 2.
- If the piece concerns a sector (finance, tax, employment), check that sector's national retention law, since those laws, not GDPR, usually set fixed periods.
- Have counsel confirm any compliance advice.
Coverage
Statute text read in full from EUR-Lex. EDPB guidance on retention and peer-reviewed studies were not retrieved; the EDPB Meta decision page redirected to a news list, so only the DPC press release and a September 2026 EDPB news item were read. No rows skipped.