Data Retention Policies Explained: Legal Hold and Disposal for Security+

A data retention policy defines how long each type of data is kept and what happens to it afterwards. The security argument is counterintuitive to most organisations: data you no longer need is a liability, not an asset.

Why over-retention is a risk

Every record you hold can be breached, subpoenaed or misused. Data kept past its purpose adds risk while adding no value.

Under GDPR, storage limitation is a principle in its own right — personal data may be kept only as long as necessary for the purpose it was collected for. Holding it longer is a compliance failure even if nothing goes wrong.

There is also a litigation dimension: material that still exists is discoverable. Organisations have been damaged by decade-old emails that a defensible retention schedule would have disposed of years earlier.

And there is cost. Storage, backup windows, and the effort of protecting and classifying data nobody uses.

Why under-retention is also a risk

The other side, and where the balance sits.

Regulations impose minimums. Financial records typically seven years. PCI DSS requires a year of logs with three months immediately available. HIPAA sets six years for certain documentation. SOX has its own requirements. Deleting below the minimum is itself a violation.

Operationally, short log retention cripples incident response. If an intrusion had a dwell time of eight months and you keep 30 days of logs, you cannot reconstruct what happened. Detection capability is limited by retention.

Building a schedule

A retention schedule lists data types and, for each, how long it is kept, where, who owns it, the legal basis for the period, and the disposal method.

The period should be driven by the longest of: regulatory minimum, legitimate business need, and contractual obligation. If none applies, the answer is to keep it for a defined short period and dispose of it.

Typical categories: transactional records, employee records, customer personal data, security logs, email, backups and archives. Note that backups need their own treatment — a retention policy that deletes records from production while the same records live on in backups for seven years has not actually deleted anything, and that gap is a recurring audit finding.

Legal hold

The exception that overrides everything, and it is heavily tested.

A legal hold — or litigation hold — suspends routine destruction for data relevant to anticipated or ongoing litigation, investigation or audit. It takes precedence over the retention schedule, and it starts when litigation is reasonably anticipated, not when proceedings begin.

Destroying data under legal hold is spoliation of evidence, and the consequences are severe: sanctions, adverse inference instructions to a jury, and in serious cases criminal liability. The fact that an automated retention job did the deleting is not a defence, which is why holds must be capable of suspending automation.

Practically: identify custodians and data sources, issue written notice, suspend automated deletion, preserve backups in scope, track the hold, and release it formally when the matter concludes.

Disposal

Deleting a file removes the pointer, not the data. Disposal must match the sensitivity of the data and the medium.

Method	Applies to
Overwriting / secure wipe	Magnetic drives being reused
Cryptographic erasure	Encrypted media — destroy the key
Degaussing	Magnetic media only; useless on SSDs
Shredding / pulverising	Any medium, including optical and SSD
Incineration	Highest assurance
Cross-cut shredding	Paper

Two points the exam likes. Degaussing does not work on solid state drives, because there is no magnetic domain to disrupt — for SSDs use cryptographic erasure or physical destruction. And cryptographic erasure is the practical answer for cloud storage, where you cannot physically reach the medium: encrypt from the start, then destroy the key.

Where destruction must be evidenced, obtain a certificate of destruction from the disposal vendor, and maintain chain of custody for media in transit.

What to remember

Retention balances regulatory minimums and business need against the risk of holding data you do not need. Storage limitation is a GDPR principle. Legal hold overrides the schedule and begins when litigation is reasonably anticipated; destroying held data is spoliation. Backups must be covered by the policy or deletion is not real. Degaussing does not work on SSDs, and cryptographic erasure is the answer for encrypted and cloud-hosted data.

Related reading: The right to be forgotten · Sensitive data and classification · Data owner and custodian roles