Documented rules for how long you keep personal data and when you delete it.
For UK advice: FCA record-keeping minimums plus business purpose. Marketing-only data typically deleted after 2–3 years inactivity; client records retained longer per regulatory rules.