One Identity keeps your personal data for as long as it decides is necessary for its business and legal purposes, using a general risk-based approach rather than publishing specific retention periods for each data category.
This analysis describes what OneLogin's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
Without specific retention periods disclosed for each category of personal data, users cannot know how long their information will be held or easily verify that data is deleted when no longer needed.
The updated policy discloses that OneLogin may record calls with consent and use AI to analyze call transcripts, chat conversations, and sales emails for multiple purposes including follow-up task id…
One Identity does not publish specific retention timeframes for individual data categories, making it difficult to verify when your personal data will be deleted — you can request deletion at any time, but the company may retain data it deems necessary for legal or business reasons.
How other platforms handle this
We retain personal data for as long as necessary to fulfill the purposes for which it was collected, including to satisfy any legal, accounting, or reporting requirements, to resolve disputes, and to enforce our agreements. The criteria used to determine our retention periods include: the length of ...
We may retain de-identified or aggregated information that can no longer be used to identify you for any period of time, including indefinitely.
We retain personal information for as long as necessary to fulfill the purposes for which it was collected, including for the purposes of satisfying any legal, accounting, or reporting requirements, or as otherwise permitted or required by applicable law.
Monitoring
OneLogin has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 10 platforms.
"We retain personal information for as long as necessary to fulfill the purposes for which it was collected, including to satisfy legal, regulatory, accounting, or reporting requirements. When determining retention periods, we consider the amount, nature, and sensitivity of the personal information, the potential risk of harm from unauthorized use or disclosure, and applicable legal requirements.— Excerpt from OneLogin's OneLogin Privacy Policy
REGULATORY FRAMEWORK: GDPR Art. 5(1)(e) (storage limitation principle) requires that personal data not be kept longer than necessary. GDPR Art. 13(2)(a) requires disclosure of retention periods or criteria at point of collection. UK GDPR imposes equivalent obligations. CCPA/CPRA does not mandate specific retention periods but prohibits retention beyond what is disclosed as necessary. FTC Act Section 5 applies to deceptive retention practices.
Full compliance analysis
Regulatory citations, enforcement risk, and due diligence action items.
Free: track 1 platform + weekly digest. Watcher: 10 platforms + same-day alerts. No credit card required.
Professional Governance Intelligence
Need to monitor specific governance provisions?
Professional includes provision-level monitoring, governance timelines, regulatory mapping, and audit-ready analysis.
Built from archived source documents, structured governance mappings, and historical version tracking.
Without specific retention periods disclosed for each category of personal data, users cannot know how long their information will be held or easily verify that data is deleted when no longer needed.
One Identity does not publish specific retention timeframes for individual data categories, making it difficult to verify when your personal data will be deleted — you can request deletion at any time, but the company may retain data it deems necessary for legal or business reasons.
ConductAtlas has identified this type of provision across 115 platforms. See the full comparison.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by OneLogin.