Fact · Voice privacy and security
Under Article 13(2)(a) of the GDPR, a controller must tell the person, when the personal data are obtained, how long the data will be stored, or the criteria used to set that period if a fixed period is not possible.
Checked against its source on October 17, 2026
In the source's own words
“the period for which the personal data will be stored, or if that is not possible, the criteria used to determine that period”
Art. 13 GDPR: Information to be provided where personal data are collected from the data subject, gdpr-info.eu (text of Regulation (EU) 2016/679), 2016, Article 13(2)(a).
Open the original- What it measures
- Article 13 applies when personal data are collected directly from the person. The duty is to inform, and it does not set a maximum storage period.
- What it does not show
- This is an EU rule. It does not tell you what a specific app keeps, only that an EU controller must say so.