~/moritzsamrock_

Data Retention

Data Retention: Rules and controls governing how long data is kept and when it must be deleted. It should be documented, assigned to an owner, measured, and reviewed at defined intervals.

How it works and where it fits

Data Retention must be considered across the complete data lifecycle: creation, processing, transfer, storage, sharing, archiving, and deletion. Safeguards depend on sensitivity, legal obligations, business value, and potential harm. Copies, metadata, and derived information may carry the same or a different protection requirement.

Practical security relevance

In practice, this calls for classification, governed access, suitable encryption, and traceable retention periods. Data flows and storage locations should be inventoried across cloud services, backups, and test environments. Monitoring and loss prevention complement technical controls, but they do not replace data minimization or the secure deletion of information that is no longer required.

  • Data LifecycleData LifecycleThe stages through which data passes from creation and use to retention and secure deletion.: The stages through which data passes from creation and use to retention and secure deletion.
  • Data ClassificationData ClassificationAssigns data to protection classes based on sensitivity, value, and regulatory requirements.: Assigns data to protection classes based on sensitivity, value, and regulatory requirements.
  • Data WipingData WipingIrreversible removal of data using appropriate logical or physical methods.: Irreversible removal of data using appropriate logical or physical methods.
  • Information Rights ManagementInformation Rights ManagementControl over the use, dissemination, and processing of protected documents and data.: Control over the use, dissemination, and processing of protected documents and data.

Related terms