How long does Europol retain personal data, and when must it be deleted?

Europol must review the necessity of data retention at least every three years, with a general maximum retention period of five years from the date of last processing. However, extensions are permitted if the data remains necessary for Europol’s tasks. Upon expiry of retention periods, data should be automatically deleted, but systematic failures occur. If your data was collected unlawfully, is factually inaccurate, or is no longer necessary for the purpose it was originally processed, you can demand immediate deletion regardless of standard retention timelines — a request that must be answered within three months.