Data Retention
What is Data Retention?
The policies and practices governing how long an organisation keeps personal data. Privacy regulations require that personal data is not kept longer than necessary for the purpose for which it was collected.
Terms that appear alongside data retention
Each of these is named in at least one of the same controls as data retention. The number is how many controls name both.
- gdpr 9 shared controls
- consent 8 shared controls
- policy 6 shared controls
- governance 6 shared controls
- audit 6 shared controls
- compliance 5 shared controls
- purpose limitation 4 shared controls
- anonymisation 4 shared controls
Frameworks that govern data retention
What the standards actually require on data retention
Requirements naming data retention across 6 standards, quoted from the control text.
Retain data according to the enterprise’s data management process. Data retention must include both minimum and maximum timelines.
CIS-3.4 · Enforce Data Retention →Although the PPL does not impose a single retention period, the use-limitation principle (s.2 and s.8(b)) requires that information be kept only as long as necessary for the registered purpose.
PPL-DSR-RETAIN · Data Retention and Disposal →Retain data according to the enterprise data management process. Data retention must include both minimum and maximum timelines.
3.4 · Enforce Data Retention →Retain data according to the enterprise data management process. Data retention must include both minimum and maximum timelines.
3.4 · Enforce Data Retention →An operator may retain personal information collected from a child only for as long as reasonably necessary to fulfil the specific purpose for which it was collected, and must then delete it using reasonable measures to protect against unauthorised access duri...
COPPA-312.10 · Data Retention and Deletion (Written Retention Policy) →Manage data retention, archiving and deletion against business requirements and applicable law, so data is neither kept longer nor destroyed sooner than allowed.
CCM-DSP-16 · Data Retention and Deletion →Questions people ask about data retention
What is Data Retention?
Why is Data Retention important for compliance?
Which compliance frameworks address Data Retention?
Where can I learn more about Data Retention?
See how Data Retention applies across compliance frameworks
Our platform maps 686 frameworks with 311K cross-framework control mappings. Explore how this concept is addressed across standards.