Why Outbound Prospect Retention Should Anchor to Collection Date

Outbound lists age. The email you collected in March is not the same risk or the same usefulness in November, even if the row still "looks complete."

Privacy regimes do not hand agencies a single universal number of months to keep marketing data. What they do expect is a documented purpose, a reviewable limit, and a clock you can explain. Anchoring retention to the collection date is the simplest honest clock for prospect data you acquired to run outbound.

Storage limitation is a purpose problem

UK GDPR guidance on storage limitation is clear in spirit: keep personal data only as long as you need it for the purpose you collected it. There is no one-size retention period published as a magic number. You decide and document a limit that matches purpose, then delete or anonymize when that purpose ends.

For agency outbound, the purpose is usually contacting a person about a client's offer under a stated lawful basis and jurisdiction model. When the purpose ends, or when the data is too stale to justify continued processing, the row should not linger as an evergreen asset.

CCPA-style expectations also push covered businesses toward disclosed retention criteria and timely responses to deletion requests. Even when a specific statute does not apply to a given record, buyers increasingly ask how long you keep what you collect.

Why collection date beats "last enriched" as the primary anchor

Enrichment refreshes fields. It does not reset why you hold the person.

If retention is keyed only to last enrichment, a vendor refresh can quietly extend life forever. If retention is keyed only to last open or click, silent prospects never expire, and your suppression/history tables become a graveyard of maybe.

Collection date answers a basic audit question: when did this identity enter your systems for this purpose? From that date you can schedule review, deletion, or re-lawful-basis decisions. Engagement and enrichment become secondary signals inside a window, not a way to dodge the window.

GTM's product posture matches this discipline: provenance on every field, and retention anchored to collection date, with suppression surviving purge so you do not re-contact people who opted out.

A practical retention model for agency outbound

You still need a written policy. A workable outline used across B2B compliance checklists:

1. Record collection date, source, purpose, and workspace/client
2. Set a purpose-based review window for inactive prospects (common practice ranges often cited in marketing-data guidance are on the order of 12 to 24 months for inactive contacts, with some organizations using a longer outer ceiling). Treat those as policy choices to document, not as legal guarantees.
3. Run scheduled reviews or automated deletion/anonymization across every system that holds the row
4. Keep a minimal suppression record after purge so "delete" does not recreate a contactable person
5. Honor deletion and opt-out requests on a clock shorter than the outer legal floor

Agencies running many clients should scope this per workspace. Client A's retention policy and lawful basis are not Client B's.

What to ask vendors

1. Do you store a collection date per prospect identity, not only last updated?
2. Can retention jobs run per workspace?
3. Does purge remove contactable fields while preserving suppression?
4. Can we export the retention basis and source trail for a buyer questionnaire?
5. Are we clear on residency and which regimes the product claims today?

On that last point, stay honest. GTM's data model is built with GDPR in mind, operates US-only today with residency in us-east-2, and treats CCPA controls as being verified. HIPAA is not in scope. SOC 2 Type II and ISO 27001 are in progress, not certified.

Retention is not the same as suppression

Deleting a prospect because the retention window closed is a storage decision. Suppressing a prospect because they said stop is a send decision. You need both. A purge that also forgets the opt-out is a compliance bug wearing a privacy costume.

CTA

GTM keeps outbound prospect handling boring on purpose: field provenance, retention anchored to collection date, and suppressions that survive purge inside client-isolated workspaces. Join the waitlist at https://trygtm.com/waitlist.

Sources

• ICO: Storage limitation (UK GDPR)
• Vonsel: B2B data compliance checklist (GDPR + CCPA)
• SortedIQ: How long can you keep marketing data under UK GDPR?
• Sprintlaw: Data retention policies for UK lead generation agencies
• GTM product knowledge (/workspace/trygtm/knowledge/product.md)