Policies governing how long personal data is kept before secure disposal.
Data retention policies define how long different types of data are kept before disposal. GDPR's storage limitation principle requires data not be kept longer than necessary for its purpose. Retention periods depend on legal requirements (tax records, employment records), contractual obligations, and business needs. Effective retention requires knowing what data you have, applying appropriate retention periods, and securely disposing of data when retention expires.
Why It Matters
The DSC Perspective:
Keeping data indefinitely increases risk and compliance burden. Define retention periods, implement them, and actually delete data when retention expires. Data you've properly disposed of can't be breached.