Evidence
Retention schedules, and the deletion that never happens
Writing the schedule is straightforward. Making data actually leave the estate on time is where it breaks down.
Published: Facts checked:
Why does data survive its retention period?
Backups are the usual answer to why data survives its retention period, and it is a reasonable one — but it needs stating rather than discovering. Then the replicas: analytics warehouses, search indexes, caches, the exports somebody made for a report in 2023.
A defensible position is a written schedule, deletion implemented where it can be, an explicit statement of where it lags (backups, with their own rotation period), and evidence that the process runs. What is not defensible is a schedule nobody has ever executed.
The bottom line
Document where deletion genuinely lags and why. An honest exception is defensible; an unexamined schedule is not.
Related services
ISO/IEC 27701 — Privacy Information Management
Turn privacy from a policy document into a management system, with the records a regulator or an enterprise buyer will ask to see.
GDPR Compliance
Work out whether the GDPR reaches you directly or by contract, then build the records, processes and transfer answers either route demands.
Related insights
Evidence
Running an internal audit that is worth the day it costs
Its job is to find things before the external auditor does, not to pass.
Evidence
Corrective action is not the same as fixing it
A fix addresses the instance. Corrective action addresses why it happened.
Evidence
Evidence that collects itself
If producing evidence is a separate task, it will be skipped in a busy quarter.
