Data retention policy

A data retention policy is an organization’s written rule for how long each kind of data is kept, and when it is archived or deleted. The periods come from regulations, contracts, and internal needs. For file data, the policy only works when each file can be matched to a retention class.

Key takeaways

A retention policy states how long each class of data is kept and what happens next.
Retention periods come from regulations, contracts, and internal rules.
Data minimization keeps only the personal data a purpose needs, for as long as it needs it.

Why does an organization need a data retention policy?

Because keeping everything forever is costly and risky, and deleting too early can break the law. A retention policy sets how long each kind of data must be kept, so the organization meets legal and contract requirements, can delete safely when the period ends, and has a written answer when a regulator or court asks why data was kept or removed.

What does a retention policy need to work for file data?

Two things the policy itself does not supply: a way to tell which files belong to which retention class, and a record showing that the rule was applied to them. Without the first, the policy cannot reach the files. Without the second, nobody can prove it did.

How long does an organization need to keep data?

It depends on the regulation, the contract, and the jurisdiction, and periods run from a few years to permanently. For file data, the harder part is knowing which retention class a file belongs to, which is a description problem before it is a legal one.

What is data minimization?

Data minimization is the principle of keeping only the personal data a purpose needs, and only for as long as it needs it. GDPR makes it a legal requirement for personal data about people in the European Union. For file estates, it means finding copies and old versions that serve no current purpose and removing them under the retention policy, with a record of what was removed and why.

Who decides how long data is kept?

Usually the legal, compliance, or records team, based on the laws, regulations, and contracts that apply to the organization. Business owners add their own needs, such as keeping research data for a later study. The result is a retention schedule, which IT and storage teams then apply. Where no rule applies, the safest default is a written decision, not keeping everything forever.

How does Diskover help?

Diskover records a retention class on each file through metadata enrichment, so retention rules can be reported on and acted on across every storage system.

Explore file data retention

Book a demo