Data Retention Policy
A set of rules defining how long different types of data should be kept and when they should be deleted.
Also known as: Retention Policy, Data Lifecycle Policy, Records Retention
Category: Concepts
Tags: data-management, compliance, governance, security, organization
Explanation
A data retention policy establishes guidelines for how long an organization or individual should keep different types of data before securely disposing of them. These policies balance legal requirements, business needs, storage costs, and privacy considerations.
**Why retention policies matter**:
- **Legal compliance**: Many regulations require keeping certain data for specific periods (tax records, medical records, financial transactions)
- **Legal protection**: Some data must be deleted after a period to avoid liability (GDPR right to erasure)
- **Storage costs**: Keeping everything forever is expensive and unsustainable
- **Security risk**: Old data that's no longer needed becomes a liability if breached
- **Performance**: Systems slow down with excessive data accumulation
**Common retention periods**:
- **Tax records**: 7 years (varies by jurisdiction)
- **Employment records**: 7 years after termination
- **Medical records**: Varies (often 10+ years)
- **Financial transactions**: 5-7 years
- **Email communications**: 1-7 years depending on content
- **Operational logs**: 30-90 days for routine, longer for security
**Elements of a good retention policy**:
1. **Data classification**: Categorize data by type and sensitivity
2. **Retention schedules**: Define how long each category is kept
3. **Legal holds**: Process for preserving data during litigation
4. **Disposal procedures**: Secure deletion methods (not just moving to trash)
5. **Documentation**: Records of what was deleted and when
6. **Regular review**: Policies should be updated as requirements change
**Personal data retention (PKM)**:
Even for personal knowledge management, retention thinking is valuable:
- **Inbox zero mentality**: Process and archive/delete communications
- **Note lifecycle**: Some notes are temporary; don't keep everything
- **Reference expiration**: External links and sources may become outdated
- **Backup rotation**: Old backups can be pruned as newer ones accumulate
- **Project archives**: Completed project materials may not need active storage
**The retention paradox**: We can't predict what will be valuable in the future, so there's tension between keeping too much (cost, risk) and too little (lost value). The key is thoughtful categorization and regular review, not blanket policies.
Related Concepts
← Back to all concepts