Data Retention
Data retention defines how long an organization keeps different types of data and what happens when that period expires. It balances legal requirements, business needs, storage costs, and privacy obligations through policies that specify retention periods and disposal methods.
itStorage, backup, and data protection | OpenSkills.info
Course pathWalk it in order
Look it upDip in anytime
Go furtherLeaves this page
Don't Panic
Don't Panic - Data Retention
Data Retention is the subject of this course. Data retention is the controlled keeping and disposal of data over time. It answers a deceptively practical question: When should this data stop existing here? The answer is rarely one number.
The useful unit of work is a closed loop: clarify the goal and boundaries, gather the inputs the practice requires, make the decision or change, record evidence, and return with owners for the next cycle. Skipping any link leaves teams busy without durable results.
Tooling supports the loop; it does not replace it. Choose tools after the boundary and evidence model are clear. Comparing products without that model produces feature matrices that do not change how the work runs.
Common failure modes include undefined ownership, metrics that count activity instead of outcomes, and irreversible steps taken without a review path. Treat those as design defects in the practice, not as individual heroics to compensate later.
Operators should be able to explain which signals would change a decision this week. If no signal can change the plan, the practice has become ritual. Keep the feedback path short enough that evidence still influences the next cycle.
Name the owners for each stage of the loop before the work scales. Unowned stages become permanent exceptions. Record decisions with enough context that a future operator can tell why a tradeoff was accepted. Prefer fewer, sharper metrics that change behavior over broad dashboards that only describe activity after the fact.
Read the Intro for the core model. Use the Cheatsheet when you need the operating map. Updates tracks official guidance when this course configures an update source; otherwise the practice is settled without a live feed.
Where this skill leads
Relevant careers
See how this topic contributes to broader role-level skill maps.
Sources
- https://www.nist.gov/privacy-framework
Supports
- Privacy risk management across the data life cycle
- Retention and disposal as data processing actions
- Governance as a connection between organizational decisions and system design
- https://csrc.nist.gov/Pubs/sp/800/53/r5/upd1/Final
Supports
- Information management and retention controls
- Audit record retention and media protection controls
- Defined responsibilities, documented actions, monitoring, and verification
- Retention requirements derived from mission, business, legal, policy, and risk needs
- https://csrc.nist.gov/pubs/sp/800/88/r2/final
Supports
- Media sanitization definition
- Sanitization program design based on information sensitivity
- Sanitization and disposal controls for storage media
- https://csrc.nist.gov/pubs/sp/800/188/final
Supports
- De-identification as removal of the association between identifying data and a data subject
- Governance and disclosure-risk considerations for de-identified datasets
- https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng
Supports
- Storage limitation for identifiable personal data
- Accountability for demonstrating compliance
- Erasure, restriction, legal-claim, and protected-archiving considerations
- Safeguards for public-interest archiving, research, and statistical purposes
- https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-protection-principles/a-guide-to-the-data-protection-principles/storage-limitation/
Supports
- Retention schedule fields for data categories, purposes, and periods
- Purpose-based justification and regular retention review
- Deletion or anonymization when personal data is no longer needed
- Offline, shared, and backup copies as part of retention scope
- Difference between anonymization and pseudonymization
- Absence of one universal retention period for personal data
- https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/right-of-access/how-do-we-find-and-retrieve-the-relevant-information/
Supports
- Defined retention periods for archived and backed-up information
- Continued retrieval obligations for electronically archived or backed-up personal information
- Deletion as permanent discard without intent to access again
- https://www.archives.gov/records-mgmt/scheduling/sch-records
Supports
- Records schedule purpose, scope, descriptions, cutoffs, and disposition instructions
- Inventory and business-process analysis before scheduling
- Temporary destruction and permanent transfer as different dispositions
- Need to update schedules when formats, functions, or scope change
- U.S. federal records requirements as jurisdiction-specific examples
- https://www.uscourts.gov/forms-rules/current-rules-practice-procedure
Supports
- Current official source for U.S. federal procedural rules
- Preservation of electronically stored information as a litigation-specific consideration
- https://docs.aws.amazon.com/AmazonS3/latest/userguide/intro-lifecycle-rules.html
Supports
- Lifecycle expiration behavior for current objects
- Delete markers and retained noncurrent versions in versioned buckets
- Separate actions for noncurrent versions and incomplete multipart uploads
- Need to match lifecycle design to storage versioning state
- https://docs.aws.amazon.com/AmazonS3/latest/userguide/object-lock.html
Supports
- Fixed retention periods and legal holds as distinct controls
- Legal hold duration until explicit release
- Write-once protection against overwrite or permanent deletion
- Delete-marker behavior for protected object versions
- https://docs.aws.amazon.com/AmazonS3/latest/userguide/object-lock-managing.html
Supports
- Locked versions blocking lifecycle deletion
- Retention and legal-hold metadata available for inventory
- Interaction among versioning, lifecycle rules, delete markers, and object locks
