# How long must we keep security incident records?

NIS2 sets no single retention period, so decide one yourself and write down why. Several rules point the same way. The GDPR requires controllers to document every personal data breach (Article 33(5)) so that the authority can verify compliance, which implies keeping the record for as long as that check could reasonably come. NIS2 supervisors can ask for evidence of past incidents and reports, insurers may examine a claim long after the event, and limitation periods for contract and liability claims run for years in many countries. Sector rules and national laws may set their own periods. A common approach is to keep the incident register and reports for several years, and raw logs for a shorter time, deleting personal data that is no longer needed. NetSenX's alert history and audit-log retention depend on the plan; export what you must keep longer.

General information, not legal advice. National laws can add to the EU texts quoted here, for example deadlines, forms or reporting channels: check your own country's rules.

FAQ: [Incident reporting deadlines](https://netsenx.com/en/faq/reporting) · https://netsenx.com/en/faq/how-long-must-we-keep-security-incident-records

## Read next

- https://netsenx.com/en/nis2-incident-reporting-deadlines
- https://netsenx.com/en/nis2-network-monitoring

## Related questions

- [Can a network map be generated automatically from traffic for an auditor?](https://netsenx.com/en/faq/can-a-network-map-be-generated-automatically-for-an-auditor)
- [Must we document data breaches that we decide not to report?](https://netsenx.com/en/faq/must-we-document-data-breaches-we-do-not-report)
- [When must we tell the affected people about a data breach?](https://netsenx.com/en/faq/when-must-we-tell-affected-people-about-a-data-breach)
- [When does the NIS2 24-hour clock start?](https://netsenx.com/en/faq/when-does-the-nis2-24-hour-clock-start)
- [What has to be in a NIS2 early warning?](https://netsenx.com/en/faq/what-has-to-be-in-a-nis2-early-warning)