TL;DR — There is no single legal number for how long to keep employee video — retention depends on purpose, jurisdiction and your own organisation's policy. This post offers illustrative starting points to adapt, plus a simple way to actually set and enforce a deletion date instead of letting footage sit indefinitely.
- GDPR requires data to be kept no longer than necessary for its purpose — it does not set a fixed number of months or years.
- The most common real-world failure is not having a retention date at all, not picking the wrong one.
- Tie retention to purpose: a farewell video and a training recording have different reasonable lifespans.
- Write the date down somewhere you'll actually see it again, not just in the original consent text.
On this page
Why there's no single correct answer
This is general information, not legal advice. Rules vary by country and change over time — check current guidance from your relevant regulator (for UK/EU readers, the ICO or EDPB) and talk to a qualified privacy or employment professional before relying on this for a live campaign.
GDPR's storage limitation principle says personal data should be kept no longer than necessary for the purpose it was collected for — it does not specify a number of months or years, and no single figure applies uniformly across countries or purposes. Any retention period you see quoted, including the ones below, is a starting point to adapt, not a legal minimum or maximum.
Illustrative starting points by purpose
The table below is meant as a discussion starting point for setting your own policy, not a set of fixed rules. Adjust based on your organisation's own retention schedule, your jurisdiction's guidance, and the actual purpose of the recording.
| Type of video | Illustrative starting point | Why it might differ in practice |
|---|---|---|
| Farewell or welcome message, internal only | 3-12 months after the event | Some teams keep these longer as a sentimental archive with renewed consent; others delete promptly once the moment has passed. |
| Customer testimonial used in marketing | Length of the campaign, or until consent is withdrawn | Marketing use is often tied to an active campaign rather than a fixed calendar period. |
| Internal training or onboarding recording | 12-24 months or until the content is superseded | Often retained until replaced by an updated version rather than on a strict clock. |
| Recording used in a workplace investigation or dispute | As long as relevant to the matter, following your organisation's record-keeping policy | This is the category most likely to have a specific legal retention requirement attached to it — check with HR or legal before deleting anything here. |
A simple process for setting a real retention date
- Decide the purpose before you record, not after — the purpose is what determines a reasonable retention period.
- Write the specific date (not just "a few months") into the consent text shown to contributors.
- Set a calendar reminder tied to that date at the moment you create the campaign, not after it's finished.
- When the date arrives, actually review and delete rather than letting the reminder lapse unactioned.
- If you decide to extend retention past the original date, tell the people involved and ask again rather than quietly rolling it over.
What tends to go wrong
In practice, the most common issue isn't choosing a retention period that's too short or too long — it's not setting one at all. A folder of old farewell videos sitting in a shared drive for years, with nobody quite sure if it's still needed, is a more common and more avoidable problem than picking the "wrong" number of months. See the GDPR employee video checklist for where retention fits into the wider picture, and the consent form template for wording that states a retention date up front.
How to handle retention in Whoosh
Whoosh doesn't auto-delete footage on a timer for you, but the campaign structure makes it straightforward to review what you've collected in one place and delete it deliberately once your stated retention period is up, rather than losing track of it across emails and shared drives.
- 1.Decide a retention period at the same time you set the campaign's purpose.
- 2.State that period in the campaign description, not just in an internal note.
- 3.Set an external reminder (calendar, task tracker) for the deletion date.
- 4.Review and delete the campaign's footage when the date arrives, documenting that you did.
Frequently asked questions
Does GDPR specify a maximum number of months we can keep video?
No — it requires data to be kept no longer than necessary for its purpose, without naming a fixed number. The right period depends on the purpose and your own policy; check current guidance rather than relying on a number you've seen quoted elsewhere.
Can we keep a farewell video forever as a nice keepsake?
Generally, indefinite retention without a stated reason sits uneasily with the storage limitation principle. If you want to keep something long-term, consider asking the people involved again rather than defaulting to "forever".
What if we forget to delete something on the date we set?
Treat it as a prompt to delete as soon as you notice, and review your reminder process so it doesn't happen again — a late deletion is better than none, but a reliable process is better than relying on catching the mistake.
Does a shorter retention period always look better from a compliance standpoint?
Not necessarily — the right period is the one that matches the actual purpose. A period that's unrealistically short for a legitimate ongoing use (like an active marketing campaign) isn't more compliant, just less practical.