How long must I keep consent records under the PDPL?

No PDPL article sets a period for consent records as such. The Implementing Regulation requires consent documented so it can be verified later, with its time and means (Article 11), and the record of processing activities kept while processing lasts and for five years after it ends (Article 33). Keep each consent record while you rely on it.

Proof is the reason to keep it. Once SDAIA formally notifies an organisation of an alleged violation, it has five days to respond, and a consent record that was overwritten or deleted cannot show when a visitor agreed. Keep later changes and withdrawals beside the first choice, not in its place.

The PDPL's destruction rule still applies: personal data is destroyed once it is no longer needed for its purpose, unless a legal basis requires keeping it for a set period or it relates to a case before a judicial authority (Article 18). SDAIA's records guideline also asks controllers to state planned retention periods for each category of data in the record of processing.