Retention Policies: How Long Can You Keep Customer ...

Quoted on this wiki

Every place a page here uses this source, in the order the words come in it.

1. Definitions “Clearly explain how you calculate any time periods.” Secondary & Tertiary Data

   In Retention documentation and audits

2. Summary “This can include both the timescales for keeping data and the rationale for deleting it.” A good policy will explain when, how and why you delete data. It will also cover processes such as archiving and anonymizing data. It should help not only ensure consistency in your staff's actions, but prove to people that you handle their personal data responsibly.

   In Retention documentation and audits

3. Reviews “Detail this review process and timescale in your data retention policy.” Anonymization/Pseudonymization

   In Retention documentation and audits

4. In such cases it's good practice to hold on to this data a little longer in case the person who made the request has any follow-up questions or complaints. Data protection regulators around the world give different timescales but keeping the data and extra three to six months will usually be adequate. “If you adopt such an approach, clearly state it in your data retention policy to make sure you and your staff are consistent.” Native goes a step further and suspends data deletion indefinitely:

   In Retention documentation and audits

Quotes are verbatim and belong to their publishers. Where a quote has been translated, the original wording is kept below it.