Article
What's a Data Retention Policy & How Does it Affect SOC 2?
linfordco.com
Quoted on this wiki
Every place a page here uses this source, in the order the words come in it.
How Long Should Data Be Retained? “As noted previously, laws, regulations, and contractual obligations will drive the data retention period, and these can often be different.” How Do You Create a Data Retention Policy?
Define the Retention Period – Once data and requirements have been identified, organizations need to set the retention period for the data identified. For an organization that does not collect a lot of data, or that has fewer requirements to meet, one standard retention period for the applicable data categories may be sufficient. In other cases, it may be best to have multiple retention periods that differ by data classification. Organizations may also decide to further subdivide data categories so that different retention periods can be used for specific data. The details of the retention period(s) and data classification should be documented in the data retention policy. “Data Deletion – A key component of a data retention policy includes the procedures and requirements to delete data that is no longer needed or required to be retained.” What are the Data Retention Requirements for a SOC 2?
Why Should I Have a Data Retention Policy? “Often, these requirements can vary based on the business activities of the organization and the types of data collected.” How Long Should Data Be Retained?
Define the Retention Period – Once data and requirements have been identified, organizations need to set the retention period for the data identified. For an organization that does not collect a lot of data, or that has fewer requirements to meet, one standard retention period for the applicable data categories may be sufficient. In other cases, it may be best to have multiple retention periods that differ by data classification. Organizations may also decide to further subdivide data categories so that different retention periods can be used for specific data. The details of the retention period(s) and data classification should be documented in the data retention policy. “While it may seem like a good idea to hold on to as much data as possible for as long as possible, such a strategy comes with increased risk and potentially negative consequences.” What are the Data Retention Requirements for a SOC 2?
What is a Data Retention Policy? “Specifically, it defines what types of data should be retained, how long the data should be retained and in what format, and the requirements and procedures to delete data when it is no longer needed.” Why Should I Have a Data Retention Policy?