A retention policy sets how long each data bucket is kept, where it is held, and when it may be moved or deleted. Account for operational stores and backups, and confirm that the organization has the right to retain the data. section 8.5.2 section 8.5.2
For each data bucket, decide:
- How long data stays in each location, and when it ages into longer-term storage. section 8.5.2
- Which business events trigger deletion, including deletion from backups. section 8.5.2
- Whether ownership permits retention and whether special compliance requirements apply. section 8.5.2
A client leaves
If a client leaving is a deletion trigger, define whether that event removes the client’s data from both operational stores and backups. section 8.5.2
Include retention policies when mapping company data alongside security and visibility. A clear policy helps make data handling deliberate rather than leaving storage and deletion decisions implicit. section 8.10 section 8.5.2
