There is no maximum duration prescribed by the GDPR. However, the retention period must be appropriate with regard to the purpose of data processing.

Excerpt: "Personal data must not be kept indefinitely: a retention period must be set by the data processor according to the purpose that led to the collection of this data."

For more information, please visit the website of the Federal Commissioner for Data Protection and Freedom of Information (BfDI): https://www.bfdi.bund.de/DE/Home/home_node.html