Design and Audit Data Retention Policies

This skill designs, implements, and audits data retention policy across regulatory frameworks, industries, and technical systems. Its core principles are purpose limitation (retain data only as long as the original collection purpose requires), proportionality (retention periods matched to business need and legal requirement), data minimization (keep only what's genuinely needed, not everything that might be useful), and transparency (clear documentation of what's retained, for how long, and why). Its risk-based approach classifies data by sensitivity (public, internal, confidential, restricted), accounts for legal-hold and disclosure obligations, balances storage cost against compliance risk and business value, and factors in cross-border transfer restrictions.

It maps specific regulatory requirements: under GDPR, personal data is retained no longer than necessary and tied to its lawful basis, with individual rights to erasure, portability, and rectification; special categories of data get only strictly necessary retention with additional safeguards and immediate deletion on consent withdrawal; children's data gets enhanced protection, the shortest possible retention period, and required parental consent. Industry-specific periods it names: healthcare (HIPAA) - medical records for 6 years from last treatment, billing records 7 years, audit logs 6 years; financial services - transaction records 7 years under SOX, customer communications 3-7 years, audit trails 7 years, anti-money-laundering records a minimum of 5 years; education (FERPA) - student records retained permanently as transcript, disciplinary records 7 years, application records 1 year if the applicant isn't enrolled.

It structures a full policy document - scope and applicability, a data classification matrix mapping category to retention period, disposal method, and legal basis (for example, customer PII for 7 years after the relationship ends via secure deletion under contract performance, or system logs for 13 months via automated purge for security monitoring) - and defines retention triggers: creation date, last activity, contract end, and legal hold, which suspends normal disposal.

For implementation it describes an automated retention manager that checks legal holds first, computes each record's retention end date from its creation and last-activity dates against policy, and returns a retain, archive, or disposal action - executing secure deletion (crypto-shredding) or anonymization and logging every disposal with the policy version, executor, and a disposal certificate for audit. At the database level it tracks retention metadata (classification, policy id, retention end date, legal-hold flag, disposal method) and runs a cleanup procedure over records past their retention date and not under hold. Across microservices it orchestrates retention execution on a schedule, triggering each service's own retention endpoint. For compliance monitoring it generates a report covering policy coverage, over-retention risk, deletion backlogs, legal-hold status, cross-border compliance, and subject-rights (erasure request) fulfillment.

Use it to design, implement, or audit a data retention policy spanning legal and regulatory mapping (GDPR, HIPAA, SOX, FERPA), a classification-driven retention schedule, and the automated systems that enforce it. It is explicitly risk-based rather than keep-everything by default - purpose limitation and data minimization mean data is retained only as long as its original collection purpose requires, not because it might be useful later.

Output spans a policy document with a data classification matrix, regulatory mappings for GDPR categories and named industry retention periods, an automated retention-manager design, database schema and cleanup logic, cross-service orchestration, and a compliance monitoring and reporting layer covering over-retention, deletion backlogs, and subject-rights fulfillment.

Its implementation patterns span a relational database (retention metadata table and cleanup procedure), a retention-manager and compliance-monitor service layer, and a Kubernetes CronJob that orchestrates retention execution across microservices by calling each service's own retention API.

Legal, compliance, data governance, and engineering teams who need a defensible retention policy plus the technical systems - database, cross-service orchestration, and compliance reporting - that actually enforce it.