GDPR beyond consent: why retention and minimization are the real compliance failures

Consent has been the face of GDPR since May 2018. Cookie banners proliferated, privacy policies grew to thirty-page monuments no one reads, and compliance teams celebrated. Meanwhile, organizations kept hoarding data they no longer needed, processing personal attributes they never justified, and building data pipelines that treated minimization as a nice-to-have. Eight years on, this is where the real exposure sits.

The consensus view: consent is the core

The conventional compliance posture is understandable. Consent is visible, auditable, and maps neatly onto product decisions. A DPO can point to a consent management platform and show regulators something tangible. Fines like the 1.2 billion euro Meta penalty from Ireland's DPC in 2023 reinforced the narrative: cross-border transfers and lawful basis violations are what regulators pursue. Boards absorbed that lesson and funded consent infrastructure accordingly.

There is also a legitimate technical argument for prioritizing consent. Downstream data use is difficult to control without first establishing a lawful basis at the point of collection. Many legal teams argued, reasonably, that getting consent right was the foundation on which everything else would be built.

Where this picture breaks down

The problem is that "consent-first" became "consent-only." Retention schedules and data minimization, both explicit requirements under Articles 5(1)(c) and 5(1)(e) of the Regulation, were treated as operational housekeeping rather than legal obligations. They are not.

Retention failures are now surfacing in enforcement. France's CNIL and the UK's ICO have both issued findings tied to organizations keeping personal data well beyond its stated purpose, even data that was collected on a valid lawful basis. The consent was fine. The continued storage was not. These are structurally different violations, and no consent management platform catches them.

Minimization is worse. The modern data warehousedata warehouseA central repository that consolidates data from many source systems into a structured, query-optimized store designed for analytics, reporting, and business intelligence.View full definition → makes it trivial to ingest everything and decide later what to use. That logic, appealing to engineers and product teams, is precisely what Article 5(1)(c) prohibits. "Adequate, relevant and limited to what is necessary" is not a retrospective judgment. The proliferation of cloud data platforms has made over-collection a default architectural choice.

This is where the 2026 data tooling landscape becomes directly relevant, and where CDOs should look carefully. dbt Labs recently announced its 2026 Partner of the Year winners: phData, Snowflake, Cívica, Datum Studio, and 66degrees. The announcement (from dbt Labs, a commercial vendor in data transformation, and worth reading with that in mind) signals where the industry is investing: transformation logic, modular data modeling, and warehouse-native processing at scale. These tools are genuinely useful. But they are optimized for moving and transforming data efficiently, not for governing how long it should exist or whether it should have been collected in the first place.

Snowflake, one of those partner winners, is an excellent example. It is technically straightforward to implement retention-based table expiry in Snowflake. Governance features for tagging and policy-based access exist. Yet most implementations treat these as advanced configurations rather than baseline requirements. The tooling supports compliance; the culture around it does not demand it.

There is a second-order effect worth naming. As organizations model more personal data through transformation layers, the lineage of personal attributes becomes harder to trace. A field that starts as a customer email becomes a hashed identifier, which becomes a feature in a segmentationsegmentationDividing a market into distinct groups of customers who share similar needs, characteristics or behaviours, so each group can be served with a tailored approach.View full definition → model. Understanding where that data was born and what happened to it is a legal necessity, not a data engineering curiosity. Most organizations using dbt or similar tools have invested in lineage for operational reasons. Few have closed the loop to their privacy teams.

The AI dimension adds further pressure. Feeding personal data into large language modellarge language modelA Large Language Model is an AI system trained on vast text data to predict and generate language, enabling tasks like writing, summarizing, and answering questions.View full definition → pipelines, whether for retrieval-augmented generation or fine-tuningfine-tuningFine-tuning adapts a pre-trained model to a specific task or domain by continuing training on a smaller, targeted dataset, improving accuracy and style for that use case.View full definition →, creates new minimization obligations that most DPOs have not caught up with. A KDnuggets analysis of AI agent orchestration platforms from earlier this year described "persistent runtimes" and stateful memory as architectural defaults. For GDPR purposes, persistent personal data in AI memory is personal data in storage, and it needs a retention policy.

What a sharp CDO should actually do

Start by treating retention schedules as infrastructure, not documentation. A retention policy that lives in a Word document somewhere and has no enforcement mechanism in the data platform is not a retention policy. It is liability with formatting.

MapMapUsing software to automate repetitive marketing tasks and campaigns, enabling personalisation at scale across channels like email, web, and social.View full definition → your personal data inventory to transformation logic. If you are using dbt or a comparable tool, every model touching personal data should carry metadata indicating the data subject category, the lawful basis, and the retention period. This is not a theoretical best practice. It is the kind of operational evidence a supervisory authority will ask for when investigating a complaint. Yourapproach to data classification and access control should feed directly into that model metadata, not sit in a separate governance silo.

Push back on the "collect everything, filter later" engineering culture. This requires CDOs to be present in architectural decisions, not just governance reviews. When a data engineering team proposes ingesting a new personal attribute into the warehouse, the minimization question should be asked before the pipelinepipelineAll active sales opportunities across the stages of the sales process, together with their combined potential value and probability of closing.View full definition → is built. Retrofitting minimization is always more expensive.

On the tooling partnerships: the dbt Labs 2026 partner ecosystem, phData, Cívica, Datum Studio, and others, includes implementation partners with genuine data governancedata governanceData governance is the set of policies, roles, and processes that ensure data is accurate, secure, well-defined, and used responsibly across an organization.View full definition → expertise. CDOs evaluating these partners should assess not just their transformation credentials but their ability to bake privacy requirements into data models from the start. Governance should be a selection criterion, not an afterthought in the statement of work.

Finally, do not let consent fatigue become minimization negligence. The two obligations are legally independent. A regulator examining a retention violation does not care that your consent flows were impeccable. The data was kept too long, and Article 5(1)(e) does not contain an exception for organizations that did the easy compliance work well.

The practical implication is straightforward: run an audit of your five largest personal data datasets and ask, for each one, what the documented retention period is and whether it is being enforced at the platform level. In most organizations, that audit will surface more exposure than the last three consent reviews combined.