MD007Retention of communications metadata

The retention of the transmission data of a message: its parties, times, size, and routing.

Control	Jurisdiction	Source	What it establishes	Prerequisite or recommendation
MD007/ITMandatory	Italy	Provvedimento n. 243Garante per la protezione dei dati personali · read 11 Aug 2026Provvedimento n. 165, ITAS MutuaGarante per la protezione dei dati personali · read 16 Aug 2026Provvedimento n. 364, guidance document on email metadata in the workplaceGarante per la protezione dei dati personali · read 11 Aug 2026	That ninety days of metadata and browsing logs, kept without the procedural steps, draws a fine, the reasoning turning on the steps and not the purpose.	Twenty-one days is the outer limit before the article 4 route is engaged, and the limit reaches the envelope only: parties, times, size, and routing.
MD007/ROMandatory	Romania	Legea nr. 190/2018, articolul 5Parlamentul României · read 5 Oct 2026	That monitoring by electronic communications or video surveillance at the workplace on the employer’s legitimate interest is lawful only on five cumulative conditions, among them prior consultation of the union or the employee representatives, prior complete and explicit information of the employees, proof that less intrusive means have failed, and a retention of no more than 30 days.	Personal data from monitoring by means of electronic communications are kept for a period proportionate to the purpose and no longer than 30 days, save express legal provision or a duly justified case.