A practical checklist for data retention

Every audit we run turns up some version of this. Run through this the next time data retention comes up.

Data outlives the applications built on top of it, which is why the model deserves more thought than the screens. The version that survives contact with a real deadline is the simple one.

The checklist

• Keeping everything forever is a liability, not an asset
• Retention rules should be written down and enforced automatically
• Deletion has to work across backups too
• Someone is named as the owner
• There is a date to review it again

What it costs to ignore

Keeping everything forever is a liability, not an asset. The cost of getting this wrong is rarely visible on the day it happens. Assume whoever inherits this will have half your context and none of your patience.

How to tell if yours is fine

Numbers get quoted in meetings long after anyone remembers how they were calculated. Three things worth confirming about data retention before you move on:

• Someone can say what the current setup is without going to look
• Keeping everything forever is a liability, not an asset — and you know whether that is true here
• There is a way to tell whether the last change to this helped

Pick the one that would hurt most if it failed, and start there.