What is data retention?

Under Law 25 this is an obligation rather than a preference: personal information should not be kept indefinitely simply because storage is cheap. In practice most businesses have never set a policy, which means the answer is forever. Setting it involves deciding per category, writing it down, and making deletion actually happen on schedule, which is the part that requires building rather than deciding.