http://www.legislation.gov.uk/id/ukpga/2018/12

PART 4Intelligence services processing

The fifth data protection principle is that personal data must be kept for no longer than is necessary for the purpose for which it is processed.