Data retention

Trash bin

When a user deletes a file it moves to the trash bin. The retention policy is controlled by trashbin_retention_obligation:

'trashbin_retention_obligation' => 'auto',

Available values:

• auto (default) — keep deleted files for at least 30 days; remove sooner if the user is running low on quota.

• D1, auto — keep for at least D1 days; remove sooner if quota is low.

• auto, D2 — remove sooner if quota is low; guarantee deletion after D2 days regardless.

• D1, D2 — keep for at least D1 days; guarantee deletion after D2 days.

• disabled — never automatically empty the trash bin.

For GDPR purposes, disabled means deleted files are retained indefinitely — avoid it unless you have a specific reason. Setting a firm maximum (e.g. '30, 60') gives users a predictable deletion guarantee.

Users with the appropriate permissions can empty their own trash bin at any time from the Files app, or an administrator can run:

sudo -E -u www-data php occ trashbin:cleanup <uid>

To expire files across all users according to the current policy:

sudo -E -u www-data php occ trashbin:expire

File versions

The Versions app stores previous copies of modified files. Retention is controlled by versions_retention_obligation:

'versions_retention_obligation' => 'auto',

Available values:

• auto (default) — versions are pruned according to a built-in schedule (more versions kept for recent changes, fewer for older ones). See :doc:`../configuration_files/file_versioning`.

• D, auto — keep versions for at least D days, then apply the automatic schedule.

• auto, D — apply the automatic schedule; guarantee deletion after D days.

• D1, D2 — keep for at least D1 days; guarantee deletion after D2 days.

• disabled — never automatically remove versions.

To remove versions immediately:

sudo -E -u www-data php occ versions:cleanup <uid>
sudo -E -u www-data php occ versions:expire <uid>

Activity log

The activity log records file and sharing events per user. Entries older than the configured number of days are deleted by the daily cron job:

'activity_expire_days' => 365,

Set this to a lower value to reduce the personal data footprint. Setting it to 0 disables automatic expiry (entries are kept indefinitely).

Remember-me tokens

When users select "Remember me" at login, Nextcloud stores a long-lived authentication cookie. Its lifetime is controlled by:

'remember_login_cookie_lifetime' => 60 * 60 * 24 * 15,

The default is 15 days. Reducing this value means users must re-authenticate more frequently but limits the exposure window for stolen tokens.

Session lifetime

Active sessions expire when the browser is closed (session cookies). There is no server-side session expiry setting in core; sessions are invalidated when the user logs out or an administrator revokes them via:

sudo -E -u www-data php occ user:auth-tokens:delete <uid>

Server and web server logs

Web server access logs and the Nextcloud application log contain IP addresses and other personal data. Storing them indefinitely is not considered legitimate usage under GDPR. Rotate logs regularly and encrypt archived logs to protect the personal data they contain.

A minimal logrotate configuration that rotates daily and keeps logs for a limited period:

/var/log/nextcloud/*.log {
    daily
    rotate 90
    compress
    shred
    missingok
    notifempty
}

Adjust the rotate value to match your legal obligations and security requirements. If you are legally required to retain logs for a specific period (e.g. for compliance with national cybersecurity laws), that overrides the minimisation principle — but you must disclose the retention period in your privacy policy.

Backups

When you fulfil a right-to-erasure request by deleting an account, the data also exists in any backups you hold. GDPR's right to erasure extends to backup copies unless retaining them is required by law or necessary for legal defence.

Practical approaches:

• Time-limited backups — set a backup retention policy (e.g. 90 days) so that personal data is eventually purged from backups automatically, even if you cannot remove it on demand.

• Isolated backups — ensure backups can never be restored to a live production instance without a deliberate recovery procedure, so that deleted data cannot accidentally reappear.

• Encrypted backups — encrypt backup media so that the data cannot be read if the media is lost or transferred.

Summary table