Log retention

A retention decision has two opposing legal and operational pressures. On one side, investigations need history: intrusions are often discovered weeks or months after initial access, and indicators shared by others must be searched retroactively. On the other side, GDPR Art. 5(1)(e) (storage limitation) and Art. 5(1)(c) (data minimisation) forbid keeping personal data, which most security logs contain (usernames, IP addresses, email addresses, device identifiers), longer than necessary for the purpose. Art. 32 simultaneously makes logging part of appropriate security, so the result must be a documented, purpose-based period per log type rather than "keep everything" or "delete quickly".

Frameworks give reference points rather than a single number. CIS Controls v8 safeguard 8.10 requires retaining audit logs for a minimum of 90 days. PCI DSS v4.0 requirement 10.5.1 requires at least 12 months of audit log history, with at least the most recent three months immediately available for analysis. NIS2 does not fix a period in the directive itself; Commission Implementing Regulation (EU) 2024/2690, which applies to certain digital service providers, sets detailed monitoring and logging requirements in its point 3.2, including protection of logs and a defined retention period, and the DORA RTS on ICT risk management (Delegated Regulation 2024/1774, Art. 12) requires financial entities to define logging procedures including retention. In Denmark, the pre-GDPR security order for public authorities (bekendtgørelse nr. 528 af 15. juni 2000, § 19) required logs of personal-data use to be kept for six months and then deleted; that order has been repealed, and Datatilsynet's current guidance leaves the period to a concrete, purpose-based assessment.

A retention policy should specify for each log source the purpose, the period in hot (searchable) and cold (archive) storage, the storage location and jurisdiction, protection (access control, encryption, immutability), the deletion mechanism, and who can extend retention. Legal holds must be able to suspend deletion for specific data when litigation or a regulatory investigation is anticipated. Pseudonymisation, field-level reduction or aggregation can extend useful retention of security data while reducing personal-data exposure, for example by keeping full authentication logs for a year but reducing web access logs to aggregates after 90 days.

Frequent errors include retention set implicitly by SIEM licence cost rather than by policy, deletion that never happens in backups and archives, and retention periods that differ silently between the source system, the SIEM and the archive. Log retention is distinct from records retention under accounting law (in Denmark, bogføringsloven), and from the telecom data-retention rules, which concern traffic data kept by providers for law enforcement rather than an organisation's own security logs.