Under the GDPR, you can only hold personal data for as long as necessary to complete the purpose for which it was collected. This will vary by case, but you should always strive to keep data for the shortest time possible.