<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: implementing-data-retention-automation
description: >-
  Automate data retention policy enforcement including retention schedule
  management, automated purging workflows, legal hold integration, and
  compliance auditing per GDPR Art. 5(1)(e) storage limitation.
domain: cybersecurity
subdomain: privacy-engineering
tags:
  - data-retention
  - storage-limitation
  - gdpr
  - purging
  - legal-hold
  - lifecycle
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: []
  mitre-attack: []
---

# Implementing Data Retention Automation

## Overview

Data retention automation enforces the storage limitation principle (GDPR
Art. 5(1)(e)): personal data must not be kept longer than necessary for its
processing purpose. Manual retention management fails at scale. This skill
implements retention schedule configuration, automated purge workflows, legal
hold overrides, and compliance auditing across data stores.

Mode: `[MODE: PRIVACY]` — Storage limitation and data lifecycle management.

## Prerequisites

- Python 3.10+ with `json`, `datetime` modules
- Data inventory with retention requirements per category
- Access to data stores for purge execution
- Legal hold notification workflow
- Backup and archive management access

## Key Concepts

### Retention Period Guidelines

| Data Category | Typical Retention | Legal Basis |
|---------------|-------------------|-------------|
| Transaction records | 7 years | Tax/financial regulation |
| Customer contact data | Duration + 30 days | GDPR Art. 6(1)(b) |
| Marketing consent | Until withdrawal | GDPR Art. 7(3) |
| Employee records | Duration + statutory | Employment law |
| Server logs | 90 days | Legitimate interest |
| Security logs | 1 year | GDPR Art. 6(1)(f) |
| Analytics data | 26 months (max) | GDPR Art. 5(1)(e) |

### Retention Policy Schema

```python
RETENTION_POLICY = {
    "data_category": "customer_contact",
    "retention_period": "P2Y",       # ISO 8601 duration
    "legal_basis": "Art. 6(1)(b)",
    "purge_method": "hard_delete",   # hard_delete | soft_delete | anonymize
    "legal_hold_override": True,
}
```

### Scanning CLI

```bash
# Scan data stores for retention compliance
node scripts/agent.js --action scan \
  --policy /tmp/retention_policy.json

# Identify data past retention deadline
node scripts/agent.js --action find-expired \
  --policy /tmp/retention_policy.json

# Execute purge for expired data (dry run)
node scripts/agent.js --action purge --dry-run \
  --expired /tmp/expired_data.json

# Check legal hold status before purge
node scripts/agent.js --action check-holds \
  --data-categories "customer_contact,transaction"
```

## Workflow

### Step 1: Define Retention Schedule

```bash
node scripts/agent.js --action scan --policy /tmp/retention_policy.json
```

### Step 2: Find Expired Data

```bash
node scripts/agent.js --action find-expired --policy /tmp/retention_policy.json
```

### Step 3: Check Legal Holds

```bash
node scripts/agent.js --action check-holds \
  --data-categories "customer_contact,transaction"
```

### Step 4: Execute Purge

```bash
node scripts/agent.js --action purge --dry-run --expired /tmp/expired_data.json
```

Always run purge in dry-run mode first. Verify legal hold status.
Archive purge logs for accountability (Art. 5(2)).

## Verification

- [ ] Retention schedule defined for all data categories
- [ ] Automated scanning identifies data past retention deadline
- [ ] Legal hold override prevents purging litigation-relevant data
- [ ] Purge workflow tested in dry-run before production execution
- [ ] Backup retention aligned with primary data retention
- [ ] Purge audit logs maintained for accountability
- [ ] Third-party processors notified of retention requirements (Art. 28)

## References

- [GDPR Article 5(1)(e) — Storage Limitation](https://gdpr-info.eu/art-5-gdpr/)
- [GDPR Article 17 — Right to Erasure](https://gdpr-info.eu/art-17-gdpr/)
- [ICO Storage Limitation Guidance](https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/principles/storage-limitation/)
- [NIST SP 800-88 — Media Sanitization](https://csrc.nist.gov/publications/detail/sp/800-88/rev-1/final)
