Data Protection: Age Assurance
(asked on 9th July 2026) - View Source
Question to the Department for Science, Innovation & Technology:
To ask the Secretary of State for Science, Innovation and Technology, pursuant to Answer of 7 July 2026 to Question 14208, what guidance her Department has issued on the maximum period for which personal data collected for age assurance purposes should be retained.
Answered by
Kanishka Narayan
Minister of State (Cabinet Office) (Jointly with the Department for Business, Innovation, Science and Technology)
The government takes the threats of cyber-attacks and data breaches very seriously, which is why the ICO has the power to investigate any concerns raised about the misuse or mishandling of data. It can issue enforcement notices and substantial fines where organisations are found to be in breach of their obligations.
Organisations are required under UK GDPR and the Data Protection Act to keep personal data secure and process it fairly, lawfully, and transparently. Whilst the law does not set specific time limits on how long personal data can be held, it stipulates that it cannot be kept for longer than needed.