Retention Schedule
What is Retention Schedule?
A documented timetable specifying how long different categories of personal data should be retained before secure disposal or anonymization.
Terms that appear alongside retention schedule
Each of these is named in at least one of the same controls as retention schedule. The number is how many controls name both.
- consent 5 shared controls
- lawful basis 4 shared controls
- data minimisation 4 shared controls
- gdpr 4 shared controls
- anonymisation 3 shared controls
- compliance 3 shared controls
- audit 3 shared controls
- data subject 3 shared controls
Frameworks that govern retention schedule
What the standards actually require on retention schedule
Requirements naming retention schedule across 6 standards, quoted from the control text.
A controller or processor must adopt and implement a retention schedule prohibiting use or retention of non-exempt personal data after the initial purpose is satisfied, after the contract under which it was collected ends, or two years after the consumer's las...
florida-digital-bill-of-rights-fdbr::501.719(3) · 501.719(3): retention schedule with a two-year inactivity limit →A private entity in possession of biometric identifiers or biometric information must develop a written policy, made available to the public, that establishes a retention schedule and guidelines for permanently destroying the identifiers and information when t...
illinois-biometric-information-privacy-act-bipa::15(a) · Written, public retention schedule and destruction guidelines, applied →Standard 5 per Section 23 + the Schedule of the Jamaica Data Protection Act 2020: Personal data shall be kept for no longer than is necessary for the purposes for which they are processed.
JM-DPA2020-Standard5-Retention-Sec23-Time-Limit-No-Longer-Than-Necessary-Erasure-Deletion-Anonymisation · Jamaica DPA 2020 Standard 5 - Retention + Section 23 + Time Limit + No Longer Than Necessary + Erasure + Deletion + Anonymisation + Retention Schedule + Legal Hold + Backup Considerations + Storage Limitation →Monitoring information must not be kept longer than the purpose needs; the employer must have a retention schedule and delete in line with it, should base periods on business need, professional guidelines and legal duties, review them regularly, be able to jus...
uk-ico-employment-practices-and-data-protection-monitoring-workers-2023::1.15 · 1.15 Retention schedule for monitoring data, justified by business need and reviewed →The organization must not keep personal data beyond what its processing purposes need, developing and maintaining retention schedules that take account of legal, regulatory and business requirements and, where those requirements conflict, taking and documentin...
iso-27701-2019::7.4.7 · Retention →The organization shall keep its privacy policies and supporting procedures, and every earlier version replaced by an update, for as long as its retention schedule requires, because the policies in force now or at an earlier date may need to be examined, for in...
iso-iec-27701-2025::A.3.14 · Protection of records →Questions people ask about retention schedule
What is Retention Schedule?
Why is Retention Schedule important for compliance?
Which compliance frameworks address Retention Schedule?
Where can I learn more about Retention Schedule?
See how Retention Schedule applies across compliance frameworks
Our platform maps 1,016 frameworks with 316K cross-framework control mappings. Explore how this concept is addressed across standards.