Under Article 5(1)(e) of Assimilated Regulation (EU) 2016/679, UK General Data Protection Regulation (UK GDPR), personal data must be kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed (storage limitation principle). As set out in the Information Commissioner's Office (ICO) guidance: Principle (e): Storage limitation, the storage limitation principle is closely linked with the data minimisation and accuracy principles. Ensuring that the employer erases personal data when it no longer needs it will reduce the risk that it becomes irrelevant, excessive, inaccurate or out of date. In addition, personal data held for too long will, by definition, be unnecessary. The employer will need to consider what is the lawful basis or condition for retention, and for how long it remains necessary