3.9 KiB
3.9 KiB
Data Retention & Disposal Policy
Document owner: [Owner/Role]
Approved by: [Steering Committee / CISO]
Effective date: [YYYY-MM-DD]
Review cadence: [Annually]
1. Purpose & Scope
This policy establishes mandatory requirements for how long [Organization] retains data and how it is disposed of at end of life. It applies to all data classified under the Data Classification & Handling Policy, and supports GDPR principles of storage limitation and the right to erasure (Art. 17).
2. Policy Statements
2.1 Retention Schedule
| Data Category | Classification | Retention Period |
|---|---|---|
| Financial records | TLP:AMBER | 7 years (statutory) |
| Employee HR records | TLP:AMBER | Duration of employment + 6 years |
| Customer personal data | TLP:AMBER | Duration of relationship + 2 years, or per contract |
| Security/audit logs | TLP:AMBER | Per Logging, Monitoring & Retention Policy §2.3 |
| Incident forensics | TLP:RED → AMBER on closure | 3 years from closure |
| Marketing/public content | TLP:CLEAR | Business need, no mandated minimum |
Retention periods must not exceed what is necessary for the stated business or legal purpose — indefinite retention is a violation of this policy, not a safe default.
2.2 Legal Hold
- Data subject to litigation, investigation, or regulatory hold must be preserved regardless of the schedule in §2.1 until the hold is lifted by Legal.
2.3 Disposal & Destruction
- Disposal method must match the classification level per Data Classification Policy §3.3:
- TLP:CLEAR/GREEN: standard deletion.
- TLP:AMBER and above: secure delete/wipe or cryptographic erasure.
- Physical media holding TLP:AMBER+STRICT/RED data: sanitized per NIST SP 800-88 or physically destroyed.
- Disposal of AMBER+STRICT/RED data must be logged (what, when, method, who authorized).
2.4 Backup Alignment
- Backup retention must not silently extend the retention of data otherwise scheduled for deletion; deletion requests (including right-to-erasure) must propagate to backups within a defined window (≤90 days) or be documented as a technical exception.
2.5 Right to Erasure
- Verified erasure requests must be fulfilled within the statutory window (GDPR: without undue delay, within 1 month, extendable to 3).
- Exceptions (legal hold, legitimate business need) must be documented and communicated to the requester where required by law.
2.6 Enforcement
- Data retained past its scheduled disposal date without a documented legal hold or exception must be treated as a policy violation and remediated.
3. Antifragility Alignment
This policy is built to the five pillars of the organization's internal Antifragile Enterprise Manifest.
| Pillar | Applied In | How |
|---|---|---|
| 1. Structural Decoupling | §2.4 | Deletion propagating to backups prevents "the vendor's backup system" from becoming a hidden place data outlives its intended lifecycle |
| 2. Optionality Preservation | §2.1 | Disciplined retention avoids the illusion of value in hoarded data that later becomes a liability with no offsetting benefit |
| 3. Stress-to-Signal Conversion | §2.6 | Data found past its disposal date is a tracked finding, not a shrug |
| 4. Sovereign Intelligence | §2.3 | Disposal of sensitive data is logged and owned — auditable proof, not an assumption |
| 5. Asymmetric Payoff Design (Barbell) | §2.3 | Cryptographic erasure/physical destruction concentrated on AMBER+STRICT/RED; CLEAR/GREEN gets standard deletion — no moderate process applied to everything |