An operator may retain personal information collected from a child only for as long as reasonably necessary to fulfil the specific purpose for which it was collected, and must then delete it using reasonable measures to protect against unauthorised access during deletion. The 2025 amendments require a written data retention policy, posted in the online notice, stating the purposes for retention and the retention timeframe, and prohibit indefinite retention.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.