DataTerminology.comNEW
Rules specifying how long data is kept, when it is deleted, and why.
DESCRIPTION
A retention policy defines time-bound rules for storing and deleting data to meet legal, regulatory, and business requirements. Policies vary by data category, jurisdiction, and contractual obligations. They balance value, risk, and cost while supporting privacy principles like storage limitation. Legal holds can override deletions during investigations or litigation. Operationalizing retention needs data classification, metadata, automation, and auditable controls in each system. Clear documentation, evidence of enforcement, and exception handling support compliance.
ALTERNATIVE DEFINITIONS
UK ICO
A retention policy sets out how long you keep personal data and the criteria you use to determine retention periods.
Focuses on personal data and criteria-based retention periods under GDPR.
Microsoft Learn
Retention policies help you manage the life cycle of your organization’s data by keeping what you need and deleting what you don’t.
Operational framing for lifecycle management in Microsoft 365.
RELATED TERMS
Data Lifecycle Management Records Management Data Deletion Data Classification Archiving Compliance Privacy by Design Data Retention Schedule
COMPETING TERMS
Legal Hold Data Minimization
RELATIONS
- Broader: Policy
KNOWLEDGE AREAS
Data Governance Data Management Data Privacy & Compliance Data Security
TARGET AUDIENCE
Data Governance Manager Data Steward Data Privacy Officer Chief Data Officer IT Manager Chief Information Security Officer
EXTERNAL SOURCES
- Wikipedia - Records retention
- GDPR.eu - Storage limitation principle overview
- NIST - Big data framework touches governance and retention
TOP QUESTIONS
Why is a Retention Policy critical for compliance?
It operationalizes storage limitation and reduces over-retention risk. Auditable enforcement helps satisfy regulators and contracts.
Category: Relevancy
How do Legal Holds interact with a Retention Policy?
Legal holds suspend deletion for affected records until the hold is released, temporarily overriding policy rules.
Category: Concepts
What are common Retention Policy mistakes?
Setting blanket retention, ignoring jurisdictional differences, and failing to automate deletions are frequent errors.
Category: Mistakes
How should retention periods be determined?
Use legal and regulatory requirements, business value, risk appetite, and industry standards, documented in a retention schedule.
Category: Best practices
What is the risk of over-retention under a Retention Policy?
It increases breach impact, discovery costs, and privacy liability without business benefit.
Category: Risk
How is a Retention Policy enforced across systems?
Map data classes to policies, implement lifecycle rules per platform, and monitor with attestations and audits.
Category: Management
How does Retention Policy relate to data minimization?
Retention ensures timely deletion; minimization prevents collecting unnecessary data. Both reduce risk and cost.
Category: Concepts
Where to start with Retention Policy design?
Inventory data, classify it, identify legal bases and durations, then pilot automation in a high-value system.
Category: Getting Started
What’s a good example of Retention Policy scope?
Email retained 7 years for legal and audit, telemetry kept 30 days for operations, with holds for investigations.
Category: Example