Establish and Document the Application's Data Retention, Archival, and Purge Rules

This chapter explains how to establish and document how long an Application keeps its data, how data is archived, and how it is purged.

Why Retention, Archival, and Purge Rules Matter

Keeping data too briefly can breach legal and regulatory obligations; keeping it too long increases cost, security exposure, and legal risk. Without defined rules, Applications either keep everything forever or delete data inconsistently, and when an Application is retired, no one knows what must be preserved and for how long.

Establish the Rules

For each key data type the Application holds, establish, with the Business Application Owner and Risk and Compliance:

• Retention: how long the data must be kept, and why, based on business, legal, and regulatory requirements.

• Archival: when and how data is moved to archival storage, and how archived data can be retrieved when needed.

• Purge and secure disposal: when and how data is permanently deleted, and how deletion is verified.

• Legal holds: how data subject to a legal hold is protected from purging until the hold is released.

• Exceptions: who may approve exceptions to the rules.

• Instance differences: how rules differ between Instances and environments, for example where non-production environments use masked or synthetic data.

Document and Share the Rules

Record the retention, archival, and purge rules for each data type in the Application Documentation, with their sources, and record how they are implemented and verified. Link them to the Application’s Decommissioning and Full Application Retirement plans, which depend on them, and to the handling of any regulated data. Review the rules with every Release and whenever obligations change.

Best Practice: Establish and Document the Application’s Data Retention, Archival, and Purge Rules

It is a best practice to both establish and document the solution for the life of an Application’s data: define, for each data type, how long it is kept and why, how it is archived and retrieved, how it is purged and verified, and how legal holds and exceptions are handled.

Benefits: Documented rules let the enterprise prove compliance with retention obligations, reduce the cost and risk of keeping data it no longer needs, and retire Applications without either losing data it must keep or keeping data it should have destroyed.

Connections to Related IF4IT Practices and Inventories

The Non-Functional Requirements (NFRs) Framework for Software Systems addresses data retention, archival, and purge requirements. The Data and Information Inventory and Attributes describes how data and information types are recorded.