Only as long as it is needed for the purpose you gave it for, or as long as the law requires. Once you withdraw consent or the purpose is served, the Data Fiduciary must erase the data and ask its Data Processors to do the same. The Rules also require retaining certain logs and records (for example for security and legal purposes) for at least one year, and large e-commerce, gaming and social media platforms have specific retention and erasure timelines.