What is data retention?
A data retention policy, often backed by a retention schedule, lists categories of data, such as financial records, HR files, email, system logs, customer data and backups, and gives each one a retention period and a disposal method. The periods come from laws and regulations, contracts, industry standards and the organization's own needs, and they vary by country, industry and record type. Legal or compliance staff usually set them. IT carries them out.
Retention works in two directions:
- Minimum retention: some records must be kept for a set time. Deleting them early can break the law, fail an audit or damage the organization's position in a dispute.
- Maximum retention: data should not be kept longer than it is needed. Every extra year of stored personal data is more to lose in a breach, and privacy laws such as GDPR expect organizations to keep personal data only as long as necessary (data minimization and storage limitation).
Legal hold
A legal hold, also called a litigation hold, suspends normal deletion for data that may be relevant to a lawsuit, investigation or audit. While a hold is in place, scheduled purges, mailbox cleanup, backup media rotation and drive wipes must not destroy the held data, even if its retention period has expired. Email and cloud platforms such as Microsoft 365 have hold features for this. Legal or compliance staff decide when a hold starts and ends. A technician who wipes a departing employee's laptop or mailbox without checking for a hold can destroy evidence the organization was required to keep.
Retention and backups
Backup retention applies the same idea to backup copies: how many versions are kept and for how long. Rotation schemes put it into practice. In grandfather-father-son (GFS) rotation, daily (son) backups might be kept for a week or two, weekly (father) backups for a month or more and monthly (grandfather) backups for a year or longer, depending on the policy. Longer retention lets you recover from problems noticed late, such as a file corrupted months ago or malware that sat unnoticed, but it costs more storage. The 3-2-1 rule (three copies, on two types of media, one off site) deals with where copies live. Retention deals with how long they live. When a backup set's retention expires and no hold applies, its media is overwritten or destroyed according to policy.
What drives retention periods
- Tax, accounting and financial record rules
- Employment and payroll record rules
- Health care record rules for providers and insurers
- Contracts with customers and partners
- Security needs, such as keeping logs long enough to investigate incidents
- Legal holds for specific matters
Disposal at the end of retention
When a retention period ends and no hold applies, the data is destroyed so it cannot be recovered. Paper is shredded. Drives are overwritten, degaussed (magnetic media only) or physically shredded, and outside vendors usually provide a certificate of destruction. Deleting files or quick-formatting a drive does not meet that standard, because the data can often be recovered.
Data retention on the CompTIA A+ exam
Core 2 (220-1202) objective 4.6 covers regulated data and retention requirements, and objective 4.3 covers backup and recovery, where retention decides how long each backup set is kept. If a question asks why an organization keeps old email or financial records, think retention requirements. If it asks what stops normal deletion during a lawsuit, think legal hold. If a scenario has a technician about to wipe, recycle or reuse storage, check retention rules and holds first. If it asks how long GFS backups are kept, think policy-defined retention for each daily, weekly and monthly set.