Data retention directive is a law that requires companies to keep records of all data about their customers. It includes things like what internet websites people visited, who they texted or called on their phone, or what emails they sent. Companies must keep this information for at least 6 months and up to 2 years so that law enforcement can look at it if they need to investigate a crime or ensure public safety.