An owned retention schedule with legal rationale, hold controls and deletion evidence.
STAGE 01
Inventory record families
Group records by purpose and legal entity rather than assigning one period to a whole database. Include customer records, support cases, telemetry, HR records, financial records, AI inputs, exports, backups and supplier copies. Record owner, system, data types, collection purpose and dependencies.
Evidence to keep: Record-family inventory; system owners; downstream copies.
STAGE 02
Determine periods from evidence
There is no universal privacy retention period. Check the purpose, relevant statutory retention requirements, limitation periods and defensible business need. Under GDPR, identifiable data should not be retained longer than necessary, subject to applicable exceptions. Avoid copying arbitrary seven-year rules across record types or countries. Mark proposed periods for legal and business approval.
Evidence to keep: Period or criterion; source; trigger; approver.
STAGE 03
Design holds and exceptions
Document how litigation or investigation holds are authorised, scoped, reviewed and released. Restrict access to held data and avoid indefinite blanket holds. Explain how rights requests and competing obligations are considered. A business preference is not automatically a legal retention duty.
Evidence to keep: Hold owner; affected records; review and release process.
STAGE 04
Implement disposal in systems
Select deletion, sanitisation or genuinely effective anonymisation based on risk and technology. Pseudonymisation alone is not deletion. For cryptographic erasure, confirm encryption coverage, key copies, recoverability and surviving plaintext. Coordinate supplier deletion and data returns at contract exit.
Evidence to keep: Technical enforcement point; jobs; supplier commitments.
STAGE 05
Account for backups and restores
Document expiry windows and access restrictions for backup copies. Where immediate selective erasure is not feasible, validate the legal and technical treatment and ensure deleted records are not reintroduced into live systems after a restore. Test the restoration process with synthetic records.
Evidence to keep: Backup expiry; restore controls; test results.
STAGE 06
Monitor and maintain
Review deletion-job errors, unauthorised exports and stale owners. Record evidence by record family and system rather than declaring success from a policy. Update the schedule when purposes, laws, systems or vendors change. All sample schedule rows are prompts, not recommended statutory durations.
Evidence to keep: Deletion evidence; exception register; recurring review.