The controller must retain the data protection impact assessment after concluding the data processing for a minimum of two years.