Only as long as you need it for the purpose you collected it, and no longer.
The Act does not set a single number. It requires that personal data is kept no longer than is necessary for the purpose it was collected for, which means you decide the period, write down why, and then actually delete on schedule.
Other laws frequently set the floor. Accounting and tax records generally have to be kept for several years, and employment records have their own requirements. Where a retention period is imposed by another law, that law wins and you record it as the reason.
The failure mode regulators see most often is not keeping data too briefly, it is keeping everything forever because nobody decided. A retention schedule that says "customer enquiries, 2 years, then deleted" is defensible. "We have never deleted anything" is not.