Data Retention
What is Data Retention?
The policies and practices governing how long an organisation keeps personal data. Privacy regulations require that personal data is not kept longer than necessary for the purpose for which it was collected.
Terms that appear alongside data retention
Each of these is named in at least one of the same controls as data retention. The number is how many controls name both.
- gdpr 9 shared controls
- consent 8 shared controls
- policy 6 shared controls
- governance 6 shared controls
- audit 6 shared controls
- compliance 5 shared controls
- purpose limitation 4 shared controls
- anonymisation 4 shared controls
Frameworks that govern data retention
What the standards actually require on data retention
Requirements naming data retention across 6 standards, quoted from the control text.
Transient sensitive data is kept only for as long as a legitimate business purpose requires.
pci-ssf::3.2 · Secure Software Standard 3.2 (Sensitive Data Retention) →The operator must retain a child's personal information only as long as reasonably necessary for the specific purposes for which it was collected, delete it when no longer needed using reasonable measures against unauthorised access or use in deletion, never r...
coppa::312.10 · § 312.10 Data retention and deletion →The operator must keep children's personal information no longer than is reasonably needed for the particular purposes behind its collection, delete it when no longer needed using reasonable measures against unauthorised access or use in deletion, never retain...
esrb-privacy-certified::C25-312.10 · Written data retention policy published in the online notice (312.10) →Annex A disclosure item (Data control) that a public provider completes for each cloud service: How long data is kept once the customer deletes it (immediately or within a stated minimum and maximum), how long logs and customer data are retained, and which kin...
mtcs-singapore::A.4 · Disclosure: Data retention →Keep data for the periods set by the enterprise data management process, with retention defined by both a shortest and a longest period.
CIS-3.4 · Enforce Data Retention →Keep data in line with the documented data management process, with retention periods that set both a minimum and a maximum duration. Implementation Groups: IG1, IG2 and IG3 (part of the IG1 essential cyber hygiene baseline, so every enterprise applies it).
cis-controls-v8-1::3.4 · Enforce Data Retention →Questions people ask about data retention
What is Data Retention?
Why is Data Retention important for compliance?
Which compliance frameworks address Data Retention?
Where can I learn more about Data Retention?
See how Data Retention applies across compliance frameworks
Our platform maps 1,016 frameworks with 316K cross-framework control mappings. Explore how this concept is addressed across standards.