The statement discloses that Zoom retains personal data for varying periods depending on data type, purpose, legal obligations, and dispute resolution requirements, without specifying fixed retention periods for most data categories.
This analysis describes what Zoom's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
The absence of specific retention period commitments for most data categories in the statement means users and enterprises cannot determine from this document alone how long meeting recordings, transcripts, or usage data are retained. This is relevant for compliance teams conducting data minimization assessments.
Interpretive note: Specific retention periods for individual data categories are not stated in the publicly available privacy statement; actual retention schedules may be defined in product-specific or enterprise DPA terms not reflected here.
Simplified language and added that retention periods vary by data type and purpose, while removing explicit mention of 'legitimate business purposes' and 'fraud prevention.'
View full change record →The agreement establishes that personal data is retained for variable periods based on purpose and legal obligation, without committing to specific timelines for most categories. Users seeking to have data deleted before the end of its retention period may submit a deletion request through Zoom's privacy rights portal.
How other platforms handle this
We retain personal information for as long as necessary to provide our services, comply with legal obligations, resolve disputes, and enforce our agreements. The specific retention periods depend on the type of information and the purposes for which it is processed.
We keep information for as long as we need it to provide our products, comply with legal obligations, or for other legitimate purposes, such as to maintain safety, security, and integrity.
After your account is deleted, we keep data about interactions you've had on our service to prevent abuse, ban evaders and others in an effort to protect and ensure the safety and security of our service and our members.
Monitoring
Zoom has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 25 platforms.
"We retain personal data for as long as required to provide our Products, comply with legal obligations, resolve disputes, and enforce our agreements. Retention periods vary based on the type of data and the purpose for which it was collected.— Excerpt from Zoom's Zoom Privacy Statement
1. REGULATORY LANDSCAPE: GDPR Article 5(1)(e) requires that personal data be kept no longer than necessary for the purposes for which it is processed. The absence of specific retention schedules in this statement creates a potential gap relative to GDPR's storage limitation principle, which may be addressed in Zoom's DPA rather than the public privacy statement. CCPA does not impose specific retention period requirements but requires disclosure of retention practices. 2. GOVERNANCE EXPOSURE: Medium. Enterprise customers with defined data retention schedules in their own policies need to verify whether Zoom's actual retention practices align with those schedules, particularly for meeting recordings and transcripts stored in Zoom's cloud services. 3. JURISDICTION FLAGS: EEA and UK customers face the most significant exposure if Zoom's actual retention practices are not aligned with GDPR's storage limitation principle. Healthcare organizations must ensure that retention practices for PHI-containing meetings comply with HIPAA retention requirements. 4. CONTRACT AND VENDOR IMPLICATIONS: Enterprise DPAs with Zoom should specify retention periods for each data category and include deletion obligations upon contract termination. Procurement teams should verify that Zoom's standard DPA terms include enforceable retention schedules. 5. COMPLIANCE CONSIDERATIONS: Compliance teams should request Zoom's data retention schedule for each product tier and verify that it is included in the applicable DPA. Organizations should also confirm what happens to meeting recordings and transcripts stored in Zoom cloud upon account termination.
Full compliance analysis
Regulatory citations, enforcement risk, and due diligence action items.
Free: track 1 platform + weekly digest. Monitor: 25 platforms + same-day alerts. No credit card required.
Ad personalization controls removed. Contact scanning added. Advertiser data partnerships quietly dropped. A timeline of every change.
Compliance Governance Intelligence
Need to monitor specific governance provisions?
Compliance includes provision-level monitoring, governance timelines, regulatory mapping, and audit-ready analysis.
Built from archived source documents, structured governance mappings, and historical version tracking.
The absence of specific retention period commitments for most data categories in the statement means users and enterprises cannot determine from this document alone how long meeting recordings, transcripts, or usage data are retained. This is relevant for compliance teams conducting data minimization assessments.
The agreement establishes that personal data is retained for variable periods based on purpose and legal obligation, without committing to specific timelines for most categories. Users seeking to have data deleted before the end of its retention period may submit a deletion request through Zoom's privacy rights portal.
ConductAtlas has identified this type of provision across 136 platforms. See the full comparison.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Zoom.