Florida Digital Bill of Rights (FDBR) 501.719(3): 501.719(3): retention schedule with a two-year inactivity limit

A controller or processor must adopt and implement a retention schedule prohibiting use or retention of non-exempt personal data after the initial purpose is satisfied, after the contract under which it was collected ends, or two years after the consumer's last interaction, whichever applies, except data reasonably used to provide or anticipate a requested good or service in an ongoing relationship, to debug, or for internal uses aligned with consumer expectations.