Data retention policy
Also called: retention period, data lifecycle policy, deletion policy
What is a data retention policy?
A data retention policy states how long each kind of data is kept and what happens when that period ends. It makes deletion a defined, automatic behaviour rather than something that happens when somebody asks, which is what lets an organization answer how long its data lives.
What a usable policy specifies.
Three parts, and a policy missing any of them cannot actually be operated.
A period per class of data
Session transcripts, audit records, and stored memories have genuinely different useful lives and different obligations attached. One global number is either too short for the audit trail or too long for everything else.
What happens at the end
Deleted, anonymised, or moved to cold storage are different outcomes with different consequences. A period without a stated action is not a policy, it is an intention.
Which records the clock cannot be shortened for
Audit records usually have to outlive the thing they describe, and often cannot be shortened by a customer. Saying so up front is more honest than discovering it during an incident.
Why it comes up in every security review.
Because it is the difference between a claim and a control.
Answers a direct question
How long do you keep our data is asked in every procurement conversation, and only a stated period answers it.
Deletion becomes reliable
A policy that runs on a schedule does not depend on somebody remembering, which is the failure mode of every manual process.
Limits exposure by default
Data you no longer hold cannot be part of an incident. Retention is a quiet but real security control.
Commonly confused with.
Three adjacent things.
Data retention questions
What is a data retention policy?
A statement of how long each kind of data is kept and what happens at the end of that period, so deletion is defined automatic behaviour rather than something that happens when somebody asks.
Why not one retention period for everything?
Because the classes differ. Session transcripts, audit records, and stored memories have different useful lives and different obligations, so a single number is wrong for most of them.
Do backups count?
They have to be considered. A short retention period paired with indefinite backups has not really deleted anything, which is why the policy needs to cover both.
Can audit records be shortened?
Usually not, and often not by a customer. Audit records generally have to outlive what they describe, and it is more honest to say that up front than during an incident.
Is retention the same as data residency?
No. Residency is where data is stored, retention is how long. They come up together and answer different questions.
Know how long your data lives.
Retention, audit logging, and access control are stated on the security page.