Data Retention Policy

A data retention policy defines how long you keep each type of data and what happens when that clock runs out — deletion, anonymization, or archival. It's the counterweight to the default engineering instinct to keep everything forever. Privacy laws like GDPR require that personal data not be held longer than necessary, enterprise customers ask about retention during security reviews, and 'we still had it' is what turns a minor breach into a major one. Well-set retention also cuts storage cost and shrinks your attack surface: data you've already deleted can't be stolen. For AI SaaS, retention questions extend to prompts, model outputs, and logs — which often contain the most sensitive user content. Practical note: map each data type to a retention period and a lawful basis, automate deletion with scheduled jobs rather than relying on manual cleanup, remember to purge backups and derived copies (caches, search indexes, warehouses), and log deletions so you can prove compliance when asked.