GDPR doesn't set a fixed retention period - instead, personal data can only be kept for as long as it's actually needed for the purpose it was collected for.