...
Know what personal data they hold onto and why they need it.
Must be able to justify how long they keep the personal data.
have a policy with standard retention periods.
regularly review the information and erase or anonymise anonymize the whole or part of personal data they no longer need.
...
On Content revocation, the TPP MUST confirm what happens to any existing data that the TPP has already retrieved and which data they no longer require and will be deleted (per Data Protection Laws)
the TPP MUST provide an option on the consent management dashboard to allow the USer User to delete all historic data when the consent is revoked.
...