# Old data is still your data: a retention review

Ireland's regulator fined Google partly for how long it kept location data. Here is how to find what your folders keep past their purpose.

**Type:** Guide
**Published:** 2026-09-29
**Author:** Kiteworks Marketplace team

Keeping data is a decision, even when nobody made it. On September 21, 2026, Ireland's Data Protection Commission fined Google €403 million, and one of its four findings concerned how long location data was kept. Retention is easy to postpone because old files look harmless. A review that finds what has outlived its purpose, and puts the decision in front of an owner, is a practical first step.

## What the DPC decided

The [Data Protection Commission](https://www.dataprotection.ie/en/news-media/latest-news/data-protection-commission-fines-google-eu403-million-following-inquiry-googles-processing-location) concluded an inquiry into Google's Web & App Activity, Location History and Location Accuracy features between May 2018 and February 2020. It found infringements concerning lawfulness and fairness, accountability, transparency, and "its retention of location data in Web & App Activity and Location History". It imposed fines totalling €403 million and ordered Google to bring its processing into compliance within six months. [The Irish Times](https://www.irishtimes.com/business/2026/09/21/irish-data-protection-watchdog-fines-google-403m-over-gdpr-breaches/) reported it as the fourth-largest fine the DPC has issued since the GDPR came into force.

The case is about a consumer platform, not a file-sharing folder. Its relevance is the principle: how long data is kept is assessed on its own, separately from why it was collected.

## The principle in one sentence

Article 5(1)(e) of the [GDPR](https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng) says personal data shall be "kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed". The UK [ICO's guidance on storage limitation](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-protection-principles/a-guide-to-the-data-protection-principles/storage-limitation/) turns that into practice: you need "a policy setting standard retention periods wherever possible", and you "should also periodically review the data you hold, and erase or anonymise it when you no longer need it".

Neither text sets a number of years. The period comes from your purpose, your legal obligations and your policy. That is why a review starts with a threshold you choose, not one an agent invents.

## Find what has outlived its purpose

Three marketplace agents cover different parts of a retention review in Kiteworks:

- [Retention Sweeper](https://agents.kiteworks.com/catalog/retention-sweeper) finds files in a folder that are past a retention deadline you set, and can save a report of what it found. It works from file metadata; it does not decide what may be removed.
- [Folder Expiry Audit](https://agents.kiteworks.com/catalog/folder-expiry-audit) reports which folders have an expiry or retention setting configured and which do not. It reads only and cannot set expiry.
- [GDPR Compliance Check](https://agents.kiteworks.com/catalog/gdpr-compliance-check) scans a folder for personal data, sharing exposure, and files older than your retention policy, and saves a report. Its own listing says it covers the file-visible slice of the GDPR, not the full framework.

Age is a proxy, not a verdict. A file past the deadline may be under a legal hold, part of an open matter, or covered by a longer statutory period. The agents produce the candidate list; the owner decides.

## A retention review, step by step

1. Agree the retention period for each kind of folder with its owner, and write it down: contracts, HR files, project exchanges, customer correspondence.
2. Run Folder Expiry Audit to see which of those folders have an expiry setting and which rely on someone remembering.
3. Run Retention Sweeper on each folder with its agreed deadline.
4. Where personal data is likely, run GDPR Compliance Check to see which of the old files contain it, and review those first.
5. The owner checks each candidate for holds and exceptions, then deletes, anonymises, archives or keeps it, and records the reason.
6. Schedule the next review. Storage limitation is a routine, not a project.

## What to record

Keep the folder, the threshold used, the date of the review, the number of candidates, the decisions taken and any exceptions. That record shows a regulator, an auditor or your own team that retention was decided rather than left to chance. It also makes the next review faster.

If you want to plan a retention review for your folders, email `sales@kiteworks.com` or [start a conversation](https://agents.kiteworks.com/contact?source=resources). You do not need Claude or MCP setup to ask. Browse the [agent catalog](https://agents.kiteworks.com/catalog) for each agent's stated limits.

## Sources

- [Data Protection Commission fines Google €403 million following Inquiry into Google's processing of location data](https://www.dataprotection.ie/en/news-media/latest-news/data-protection-commission-fines-google-eu403-million-following-inquiry-googles-processing-location), Data Protection Commission (Ireland), 2026-09-21
- [Irish data protection watchdog fines Google €403m over GDPR breaches](https://www.irishtimes.com/business/2026/09/21/irish-data-protection-watchdog-fines-google-403m-over-gdpr-breaches/), The Irish Times, 2026-09-21
- [Regulation (EU) 2016/679 (General Data Protection Regulation)](https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng), EUR-Lex, 2016-04-27
- [Principle (e): Storage limitation](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-protection-principles/a-guide-to-the-data-protection-principles/storage-limitation/), Information Commissioner's Office (UK)

## Related agents

- [Retention Sweeper](https://agents.kiteworks.com/catalog/retention-sweeper)
- [Folder Expiry Audit](https://agents.kiteworks.com/catalog/folder-expiry-audit)
- [GDPR Compliance Check](https://agents.kiteworks.com/catalog/gdpr-compliance-check)

Canonical URL: https://agents.kiteworks.com/resources/retention-review-old-data