Rules for storing CPR numbers

In short: There is no fixed retention period for CPR numbers. You may keep one as long as you have a legitimate purpose and a basis, and must delete it when the purpose is fulfilled. Meanwhile it must be stored securely, accessible only to those who need it.

How long may you keep a CPR number?

GDPR has no table of deadlines. The storage limitation principle (Article 5(1)(e)) says personal data must not be kept in identifiable form longer than necessary for the purpose. In practice:

Name the purpose: payroll, pension, statutory reporting, a customer relationship?
Find the rule that sets the period. Other laws may require retention; for example, the Danish Bookkeeping Act requires accounting records to be kept for 5 years from the end of the financial year.
Write down a deletion deadline and follow it. Datatilsynet expects you to be able to demonstrate compliance.

How should CPR numbers be stored?

In the right system: payroll, HR or case systems have access control and deletion. Spreadsheets and email don't.
With limited access: only people who need it for their work. Review access regularly.
Encrypted where it matters: laptops and USB sticks encrypted, email encrypted in transit.
Without duplicates: every export is a new copy with its own lifetime and its own sharing.

The copies nobody remembers

The payroll system usually handles deletion and access. The problem is everything pulled out of it: the spreadsheet for the auditor, the CSV for the pension provider, the scanned contract in someone's OneDrive. Start byfinding them.

Delete properly

Deletion must be real: empty the recycle bin, remember version history and copies in mailboxes, and note that SharePoint and OneDrive keep deleted items in a recycle bin for a period before they are gone.

Sources

Not legal advice: this article is general information and does not replace an assessment of your specific situation. Ask a lawyer or your data protection officer if in doubt.