Do not keep personal data for longer than necessary for business or legal purposes. Be clear about your business and legal requirements regarding retain personal data.
Have a policy of proper removal of personal data after specified periods depending on the classification of personal data, having reference to your legal and business requirements.
Ensure personal data is updated. For example, review and classify personal data which are likely to become inaccurate over time unless it is updated?