4.1.2. Retention Policies and Secure Data Storage
💡 First Principle: Data that exists longer than necessary is a liability. Retention policies define how long data is kept (long enough to meet legal and business requirements, no longer). Where data is stored and how it's protected determines who can access it and what happens if the storage fails.
Data Retention
Retention policies are driven by:
- Legal requirements: Some regulations mandate minimum retention (HIPAA requires 6 years for its documentation — policies, procedures, and records of required actions; PCI DSS requires 1 year for audit logs, with 3 months immediately available)
- Business requirements: How long does the organization need historical data?
- Discovery/litigation holds: When litigation is reasonably anticipated, relevant data must be preserved regardless of normal retention policies
Data Storage Decisions
- Physical location: Where is the data stored? On-premises data centers are under your physical control; cloud storage relies on the provider's security.
- On-site vs. off-site: Backup data stored only on-site is vulnerable to site-level disasters (fire, flood). Off-site storage—either a secondary location or cloud—provides protection against site loss.
- Data value prioritization: Not all data is equally sensitive. Credit card numbers (PCI DSS scope) and Social Security Numbers (PII) require higher protection than marketing materials. Classify data and apply protection proportional to its value and sensitivity.
- Business impact: What is the cost if this data is lost, stolen, or corrupted? High-value data justifies higher protection costs.
⚠️ Exam Trap: Data retention is not the same as backup. Backups protect against accidental loss; retention policies define the lifecycle and legal hold of data. An organization might back up data daily but retain it for 7 years to meet regulatory requirements.
Reflection Question: A company stores customer credit card data. After a customer makes a purchase, how long should the card number be retained, and what regulatory framework governs this?
