Data retention policy

Define a rule for each data class

A data retention policy describes which data is stored for which purpose, for how long, and what happens afterward. It includes the starting point and intended deletion, anonymisation or restricted archiving. An archive flag in the same active database does not by itself govern access.

For personal data in the EU GDPR context, duration depends on the processing purpose and applicable obligations. The GDPR does not prescribe a fixed number of days for every data type. A technical default duration must not replace that assessment.

Manage a time-limited export copy

A fictional portal generates download file export-31. Its product rule makes this copy available for 24 hours from creation. The download check blocks expired copies; a deletion job subsequently removes the file. This duration is an assumption of the example, not a general statutory retention period. The original business data follows a separate rule.

Merely hiding the file in the interface does not fulfil the deletion job. The team must also establish whether copies exist in queues, caches or backups, and which durations and access restrictions apply there.

Demonstrate the operational effect

A stored duration value does not prove deletion occurred. Failed jobs must be detectable. Restoring a backup also needs a process that does not make expired export copies available for download again. The rule must therefore fit the actual storage locations and restoration paths.

Sources

• Data Protection Commission — Data retention periods

• CNIL — Define a data retention period

• OWASP — Logging