The statement establishes that Personal Information is retained for the duration of the customer relationship plus 10 years after relationship termination, subject to extension for AML obligations, litigation, investigations, audit, or legal claim protection, with a separate 3-year post-closure maximum for biometric data.
This analysis describes what PayPal's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision establishes a 10-year baseline post-relationship retention period for most categories of Personal Information, which is materially relevant to data minimization and storage limitation obligations under GDPR and UK GDPR, and creates ongoing data lifecycle management requirements for users who close their accounts. The statement's allowance for extension beyond 10 years in connection with legal claims or regulatory obligations means actual retention periods may exceed the stated baseline.
⚠ Personal Information will be retained for the stated 10-year post-relationship period as written, even after account closure, unless specific deletion rights are successfully exercised and the data is not subject to a retention exemption.
Cross-platform context
See how other platforms handle 10-Year Post-Relationship Data Retention Period and similar clauses.
Compare across platforms →"We retain Personal Information for as long as needed or is permitted in context of the purpose for which it was collected and consistent with applicable law. The criteria used to determine our retention period is as follows: Personal Information used for the ongoing relationship between you and PayPal is stored for the duration of the relationship plus a period of 10 years or such period as mandated by any applicable local law once our relationship comes to an end, unless we need to keep it longer to the extent permitted by applicable law, such as: When consistent with a legal obligation to which we are subject, or when permitted under applicable law, such as under applicable bankruptcy laws and AML obligations. In connection with litigation, investigations, audit and compliance practices, or to protect against legal claims.Excerpt from PayPal's Privacy Statement
REGULATORY LANDSCAPE: This provision requires evaluation under GDPR Article 5(1)(e), which requires that personal data be kept in a form that permits identification of data subjects for no longer than necessary for the purposes for …
Enforcement risk, jurisdiction flags, contract triggers, and due diligence action items.
Get the weekly coverage letter
Companies change their terms without announcing it. We capture governance documents, compare each new version with the last, and publish what changed, with the source text behind it. One email a week on what we found and what we could not reach.
This provision establishes a 10-year baseline post-relationship retention period for most categories of Personal Information, which is materially relevant to data minimization and storage limitation obligations under GDPR and UK GDPR, and creates ongoing data lifecycle management requirements for users who close their accounts. The statement's allowance for extension beyond 10 years in connection with legal claims or regulatory obligations …
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by PayPal.