Data Retention in Applications: The Decisions That Matter
Deciding how long different types of data are kept and building deletion into the system.
Marcus Adeyemi
Why does it matter?
Keeping everything forever increases breach impact and privacy risk, while deleting too early loses required records.
What are the numbers?
- Retention schedules different data types have different legal and business lifetimes
- Soft deletes hide records without removing them
- Backups retain data after deletion from live systems
- Automation retention rules should run automatically
What should I do?
- Write a retention schedule per data type
- Automate deletion jobs
- Document how backups are handled
- Distinguish soft deletion from real deletion
- Review the schedule with legal advice
What should I avoid?
Avoid:
- Keeping everything indefinitely
- Soft deletes presented as deletion
- Retention rules applied manually
- Backups that silently retain deleted data forever
When should I get help?
Short answer Bring in help when privacy requests reach your systems.
Where this comes from
- California Privacy Protection Agency — CCPA regulations
- National Institute of Standards and Technology — Security and Privacy Controls
The figures and practices above come from the sources listed.
Working on something like this?
We take on Web Design & Development work for teams who want it done once, properly. Tell us what you are building and we will tell you honestly whether we are the right studio for it. Start a project.
Where to go next
Spotted something wrong? Report an error on this page. We correct on the page and say what changed.
