<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: implementing-data-retention-policies
description: >-
  Implement automated data retention and deletion policies to enforce GDPR
  storage limitation (Article 5(1)(e)), define retention schedules per purpose,
  and automate lifecycle management across databases and storage systems.
domain: cybersecurity
subdomain: privacy-engineering
tags:
  - data-retention
  - storage-limitation
  - gdpr
  - lifecycle
  - deletion
  - archival
  - right-to-erasure
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: []
  mitre-attack: []
---

# Implementing Data Retention Policies

## Overview

Data retention policies enforce the GDPR storage limitation principle (Art. 5(1)(e))
by ensuring personal data is kept only as long as necessary for its processing purpose.
This skill covers defining retention schedules, implementing automated deletion and
archival pipelines, handling legal holds, and verifying that expired data is purged
across all storage locations including backups and replicas.

Mode: `[MODE: PRIVACY]` — Storage limitation and data lifecycle management.

## Prerequisites

| Requirement | Details |
|---|---|
| Data inventory with processing purposes and legal bases | Required |
| ROPA (Records of Processing Activities) with retention fields | Required |
| Database access for implementing TTL/expiry mechanisms | Required |
| Python 3.10+ for retention policy tooling | Required |
| Understanding of legal hold requirements and exceptions | Required |

## Key Concepts

### Retention Schedule Framework

```text
Per-Purpose Retention Periods:
  ┌─────────────────────┬──────────────┬─────────────────────────────┐
  │ Purpose             │ Period       │ Legal Basis                 │
  ├─────────────────────┼──────────────┼─────────────────────────────┤
  │ Transaction records │ 7 years      │ Tax/accounting obligations  │
  │ Marketing consent   │ Until withdrawal │ GDPR Art. 6(1)(a)      │
  │ Employment records  │ 6 years post-exit │ Legal obligation       │
  │ Customer support    │ 3 years      │ Legitimate interest         │
  │ Website analytics   │ 26 months    │ CNIL recommendation         │
  │ CCTV footage        │ 30 days      │ Legitimate interest         │
  │ Breach records      │ 5 years      │ Accountability (Art. 5(2))  │
  │ Consent records     │ Duration + 5y│ Accountability              │
  └─────────────────────┴──────────────┴─────────────────────────────┘
```

### Data Lifecycle States

```text
ACTIVE → ARCHIVED → DELETION_PENDING → DELETED → VERIFIED_PURGED

  Active:            In use for stated purpose
  Archived:          Purpose expired, retained for legal obligation
  Deletion Pending:  Scheduled for deletion, awaiting legal hold check
  Deleted:           Soft deleted / marked for hard deletion
  Verified Purged:   Confirmed removed from all storage (incl. backups)
```

### CLI Commands

```bash
# Define retention policy
node scripts/agent.js --action define \
  --purpose "marketing_emails" --period "24 months" \
  --basis "consent" --output /tmp/retention_policy.json

# Scan for expired data
node scripts/agent.js --action scan-expired \
  --policies /tmp/retention_policies.json \
  --output /tmp/expired_data.json

# Generate deletion manifest
node scripts/agent.js --action deletion-manifest \
  --expired /tmp/expired_data.json \
  --check-legal-hold true --output /tmp/deletion_manifest.json

# Verify deletion completeness
node scripts/agent.js --action verify-deletion \
  --manifest /tmp/deletion_manifest.json
```

## Workflow

### Step 1: Define Retention Schedule

```bash
node scripts/agent.js --action define \
  --purpose "customer_support_tickets" --period "36 months" \
  --basis "legitimate_interest"
```

### Step 2: Identify Expired Data

```bash
node scripts/agent.js --action scan-expired \
  --policies /tmp/retention_policies.json
```

### Step 3: Check Legal Holds

Before deletion, verify no active legal holds, litigation preservation, or regulatory audits.

### Step 4: Execute Deletion

```bash
node scripts/agent.js --action deletion-manifest \
  --expired /tmp/expired_data.json --check-legal-hold true
```

### Step 5: Verify Purge Across All Storage

Confirm data removed from primary storage, replicas, backups, caches, and logs.

## Verification

- [ ] Retention period defined for every processing purpose
- [ ] Automated expiry scanning runs on schedule (minimum monthly)
- [ ] Legal hold check integrated before any deletion
- [ ] Deletion covers all storage: primary, replicas, backups, caches
- [ ] Deletion logs maintained for accountability (Art. 5(2))
- [ ] Right to erasure (Art. 17) requests processed within 30 days
- [ ] Backup retention aligned with data retention schedules
- [ ] Retention policy reviewed annually

## References

- [GDPR Article 5(1)(e) — Storage Limitation](https://gdpr-info.eu/art-5-gdpr/)
- [GDPR Article 17 — Right to Erasure](https://gdpr-info.eu/art-17-gdpr/)
- [ICO Storage Limitation Guidance](https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/principles/storage-limitation/)
- [CNIL Analytics Retention Recommendation](https://www.cnil.fr/en/sheet-ndeg13-keep-data-only-long-necessary)
- [NIST SP 800-88 — Media Sanitization](https://csrc.nist.gov/publications/detail/sp/800-88/rev-1/final)
