Data Retention and Deletion Policies Explained

Information only — not legal advice.

Retention determines how long information remains available for a stated purpose. Disposal determines what happens afterward: review, deletion, transfer or another authorized outcome. Keeping everything indefinitely and deleting everything at project close are both poor default policies.

Start with categories of records and the reasons for keeping them. An issued design, a signed contract, a temporary export and a duplicate screenshot can have different uses and obligations even when they concern the same project.

Build a schedule people can apply

For each category, record:

• Its purpose, responsible owner and authoritative storage location.
• The rule or obligation supporting retention, including jurisdiction and contract where relevant.
• The event that starts the retention period, such as contract completion rather than file creation.
• The agreed period and review date; avoid inventing a universal number of years.
• Any hold that suspends normal disposal, who may authorize disposal and what evidence to retain.
• How working copies, exports, integrations and backups are handled.

An archive is a managed retained collection. Moving material into a folder named Archive does not make indefinite retention justified or guarantee continued readability.

Worked example: closing a project

Fictional example: a consultancy closes a refurbishment project. The owner identifies the issued deliverables, approvals and contractual evidence that must remain available. A dispute concerning one package creates a documented hold on the relevant records. Unnecessary duplicate downloads are assessed separately from the authoritative project evidence.

The disposal decision records the categories, applicable rule, hold check, approver, action and date. The team does not destroy held evidence merely because an automated review date arrives. It also avoids keeping every unrelated personal note under the same broad hold without considering its scope.

Deletion has several layers

Deleting an item from the working interface may leave it in a recycle bin, version history, backup or another recipient’s export. Ask the service provider what deletion means, which copies remain, how long they remain and what happens if a backup is restored.

Do not promise instant removal from all backups unless that capability has been verified. Define how deleted records are prevented from silently returning to normal use after restoration. Document any delayed deletion or restricted backup retention rather than calling it completed erasure.

Personal data needs a purpose-based decision

The GDPR text, particularly articles 5 and 17, addresses storage limitation and erasure, including qualifications and exceptions. It does not provide one retention period for all business information. Resolve applicable statutory, contractual and privacy requirements with the responsible adviser.

Pseudonymizing a name does not necessarily make a dataset anonymous if a person can still be identified through a key or other information. Treat proposed anonymization as a method to assess, not a label that automatically removes obligations.

Check the process on a sample

Choose several records and ask whether the team can identify their owner, retention trigger, current holds and intended disposal action. Review exceptions and failed deletions. For long-term records, also test whether the files remain readable and their relationships remain understandable after an export.

Continue with records management, information governance and GDPR in collaboration platforms.

Important information

This article provides general information and does not constitute legal advice or replace a qualified professional's assessment of your circumstances. Laws, official guidance, standards and product features can change. Check current primary sources and the requirements applicable to your jurisdiction, contract and project before making decisions. Examples illustrate the discussion; they are not official rulings or instructions for a particular case. For legal decisions, consult a qualified lawyer; for technical or other specialist matters, consult the responsible professional.