Review retention and deletion
Verify defined record categories, purposes, legal or operational holds, storage locations, owners, deletion behavior, and restoration implications before approving disposal.
| Field | Value |
|---|---|
| Business area | security-continuity |
| Primary role | it-security-administrator |
| Frequency | annual |
| Privacy sensitivity | high |
| Security sensitivity | high |
| Compliance review | needed |
Trigger and handoff
Trigger: Scheduled retention review, new data flow, service exit, or deletion request affecting multiple systems.
Inputs
- Data and system inventory
- Approved retention rules and holds
- Backup and integration behavior
Outputs
- Approved retention schedule changes
- Controlled deletion actions
- Exceptions and residual copies
Current manual methods
- Old policy table
- Manual folder cleanup
- Vendor default retention
Human judgment and approvals
-
Interpret purpose
-
duty
-
dispute
-
and technical reality
-
Decide proportionate treatment of backups and derived records
-
Approval: Record owner and qualified privacy or legal reviewer approve rules and material deletion
Failure modes
- Live record is deleted but exports persist
- Automated age rule deletes evidence under hold
Success metrics
- Record categories have current owners and executable rules
- Deletion evidence states known residual locations and limits