67 lines
3.9 KiB
Markdown
67 lines
3.9 KiB
Markdown
# Data Retention & Disposal Policy
|
|
|
|
**Document owner:** [Owner/Role]
|
|
**Approved by:** [Steering Committee / CISO]
|
|
**Effective date:** [YYYY-MM-DD]
|
|
**Review cadence:** [Annually]
|
|
|
|
---
|
|
|
|
## 1. Purpose & Scope
|
|
This policy establishes mandatory requirements for how long [Organization] retains data and how it is disposed of at end of life. It applies to all data classified under the [Data Classification & Handling Policy](data_classification_policy.md), and supports GDPR principles of storage limitation and the right to erasure (Art. 17).
|
|
|
|
---
|
|
|
|
## 2. Policy Statements
|
|
|
|
### 2.1 Retention Schedule
|
|
| Data Category | Classification | Retention Period |
|
|
|---|---|---|
|
|
| Financial records | TLP:AMBER | 7 years (statutory) |
|
|
| Employee HR records | TLP:AMBER | Duration of employment + 6 years |
|
|
| Customer personal data | TLP:AMBER | Duration of relationship + 2 years, or per contract |
|
|
| Security/audit logs | TLP:AMBER | Per [Logging, Monitoring & Retention Policy §2.3](logging_monitoring_policy.md) |
|
|
| Incident forensics | TLP:RED → AMBER on closure | 3 years from closure |
|
|
| Marketing/public content | TLP:CLEAR | Business need, no mandated minimum |
|
|
|
|
Retention periods **must not** exceed what is necessary for the stated business or legal purpose — indefinite retention is a violation of this policy, not a safe default.
|
|
|
|
### 2.2 Legal Hold
|
|
- Data subject to litigation, investigation, or regulatory hold **must** be preserved regardless of the schedule in §2.1 until the hold is lifted by Legal.
|
|
|
|
### 2.3 Disposal & Destruction
|
|
- Disposal method **must** match the classification level per [Data Classification Policy §3.3](data_classification_policy.md):
|
|
- TLP:CLEAR/GREEN: standard deletion.
|
|
- TLP:AMBER and above: secure delete/wipe or cryptographic erasure.
|
|
- Physical media holding TLP:AMBER+STRICT/RED data: sanitized per [NIST SP 800-88](https://csrc.nist.gov/pubs/sp/800/88/r2/final) or physically destroyed.
|
|
- Disposal of AMBER+STRICT/RED data **must** be logged (what, when, method, who authorized).
|
|
|
|
### 2.4 Backup Alignment
|
|
- Backup retention **must not** silently extend the retention of data otherwise scheduled for deletion; deletion requests (including right-to-erasure) **must** propagate to backups within a defined window (**≤90 days**) or be documented as a technical exception.
|
|
|
|
### 2.5 Right to Erasure
|
|
- Verified erasure requests **must** be fulfilled within the statutory window (GDPR: without undue delay, within 1 month, extendable to 3).
|
|
- Exceptions (legal hold, legitimate business need) **must** be documented and communicated to the requester where required by law.
|
|
|
|
### 2.6 Enforcement
|
|
- Data retained past its scheduled disposal date without a documented legal hold or exception **must** be treated as a policy violation and remediated.
|
|
|
|
---
|
|
|
|
## 3. Antifragility Alignment
|
|
This policy is built to the five pillars of the organization's internal **Antifragile Enterprise Manifest**.
|
|
|
|
| Pillar | Applied In | How |
|
|
|---|---|---|
|
|
| **1. Structural Decoupling** | §2.4 | Deletion propagating to backups prevents "the vendor's backup system" from becoming a hidden place data outlives its intended lifecycle |
|
|
| **2. Optionality Preservation** | §2.1 | Disciplined retention avoids the illusion of value in hoarded data that later becomes a liability with no offsetting benefit |
|
|
| **3. Stress-to-Signal Conversion** | §2.6 | Data found past its disposal date is a tracked finding, not a shrug |
|
|
| **4. Sovereign Intelligence** | §2.3 | Disposal of sensitive data is logged and owned — auditable proof, not an assumption |
|
|
| **5. Asymmetric Payoff Design (Barbell)** | §2.3 | Cryptographic erasure/physical destruction concentrated on AMBER+STRICT/RED; CLEAR/GREEN gets standard deletion — no moderate process applied to everything |
|
|
|
|
---
|
|
|
|
## 4. References
|
|
- **[NIST SP 800-88 Rev. 2, Guidelines for Media Sanitization](https://csrc.nist.gov/pubs/sp/800/88/r2/final)**
|
|
- **[ISO/IEC 27001:2022](https://www.iso.org/standard/27001)**
|