The agreement should specify how long the data will be retained, including any legal or regulatory requirements.