Data retention: How to create a data retention policy
Modern businesses depend on customer data. They collect it to deliver services, comply with industry regulations, and inform key business decisions. In a digital-first economy, sound data collection is essential for businesses to stay competitive and grow.
But storing customer data indefinitely may not be in a business’s best interest. After all, data storage has its costs. According to some estimates, businesses spent almost $60 billion on cloud data storage alone last year, with costs expected to more than double by 2028. Holding onto customer data indefinitely can also heighten the risk of data breaches and incur regulatory consequences like steep fines or even business closure.
In other words, any company or organization in the business of collecting customer data needs a plan for how long it will keep customer data, how that data will be accessed and used, and when it can be deleted. That’s where a data retention policy comes into play.
Below, we’ll explain what a data retention policy is and why it matters for modern businesses. We’ll also discuss how you can create a policy that protects your business while respecting your customers’ privacy.
What is data retention?
Data retention is a process that your business undertakes to store (or retain) certain types of data that it has collected, typically for a set period of time.
Depending on your business and industry, this can include customer data, user data, vendor data, employee data, patient data, and more. What you retain — and for how long — is determined by your business’s structure, regulatory obligations, and other factors.
Once the data is no longer needed, it should be deleted to reduce the costs and risks associated with unnecessary storage. This might be the case when business needs have changed, compliance and recordkeeping timelines have been met, or the data has become outdated.
What is a data retention policy?
A data retention policy is a document that officially establishes and outlines your business’s plans for data retention. It’s also sometimes called a records retention policy.
Practically speaking, it’s a set of guidelines that you should follow to meet your business needs while remaining compliant. Your retention policy should define, with as much specificity as possible:
What data your business will retain
How the data will be used, secured, and protected
Whether or not any backups will exist
Who has access to the data
How long the data will be stored
Whether the data will be deleted or archived once this time has passed
Procedures in case of a data breach or inappropriate access
It’s typically considered a best practice to make your retention policy available to your customers or users; in some jurisdictions, you might be required to do so by law. To cite just one example: Mozilla provides a privacy notice that outlines how it uses customer data and what customers can do.
Why is it important to have a comprehensive data retention policy?
Besides simply being a good business practice, it’s important to have a data retention policy in place for two key reasons: Regulatory compliance and customer trust.
Regulatory compliance
Depending on the jurisdictions and industries your business operates within, it may be subject to laws that either require or limit data retention. A data retention policy ensures that you are compliant with the laws that affect your business.
In the United States, for example, several federal and state laws require certain types of businesses to retain certain records for a minimum period of time. A few examples include:
Bank Secrecy Act (BSA): Banks and financial institutions must retain records (including a customer’s identifying information and activity) for at least five years. This is also known as the Five-Year Banking Rule.
Health Insurance Portability and Accountability Act (HIPAA): Covered entities must retain HIPAA-related documents for a minimum of six years.
State education laws: While federal laws do not require schools to retain student records for a minimum period of time, a number of state laws do. In Washington State, for example, schools are required to keep student records for at least 50 years after the student’s enrollment.
Meanwhile, other laws require that records be deleted when they are no longer necessary. Some examples include:
General Data Protection Regulation (GDPR): Businesses that collect customer data are required to delete it once it is no longer necessary for business purposes (among other requirements).
Illinois Biometric Information Protection Act (BIPA) and Colorado Privacy Act (CPA): Businesses may only retain an individual’s biometric information for no more than three (3) years and two (2) years, respectively.
Children's Online Privacy Protection Act (COPPA): Businesses that collect a child’s personal information must delete it when it is no longer necessary or when parents request it be deleted.
Family Educational Rights and Privacy Act (FERPA): In the US, schools and educational institutions are required to delete student records when they are no longer needed.
As a note, this is not meant to be an exhaustive list — simply an illustrative one. There are many laws influencing data retention and deletion around the world.
Customer trust
When it comes to collecting or storing personally identifiable information, trust is of the utmost importance. Customers increasingly expect transparency and control. In the event of a data breach, how will you handle their security?
Your data retention policy is an opportunity to build trust. Make it clear to your customers why you’re collecting their data, how you will secure it, and how you plan to use it.
Lack of transparency can have the opposite effect, turning off some users who are wary of handing over data when they don’t know how it will be used. Likewise, if individuals don’t feel their data is secure or within their control, your brand’s trustworthiness may suffer.
How to design your data retention policy
When it comes to creating a data retention policy, there is no one right way to do it, so long as you include the following key steps:
1. Understand your legal and compliance obligations
Your business may be subject to laws or regulations that require or limit customer data retention. Those requirements and limitations should form the bedrock of your policy guidelines. Work with members of your legal and compliance teams to answer questions like:
What data retention, security, or privacy regulations is your business subject to?
Do these regulations apply across the board, or only to certain types of customer data?
Do the regulations require you to retain customer records for a minimum period of time? Alternatively, do they require you to delete customer records after a period of time?
What are the risks of non-compliance?
What is your company’s tolerance for this risk?
If you operate in multiple jurisdictions, do requirements vary from country to country or from state to state?
2. Determine your business requirements
Armed with this understanding, you can begin to layer in your company’s business requirements as they pertain to customer data. What type of data do you plan to collect from your customers, and how do you plan to use it? What business objectives will collecting this data help you work toward?
Here, it’s a good idea to loop in members of your product, sales, marketing, customer support, and customer acquisition teams, as well as any pertinent members of the C-Suite or senior leadership. Anyone that has a potential stake in customer data should be involved in the conversation.
3. Categorize this data
Not all customer data is created equally. Some — like personally identifiable information (PII), protected health information (PHI), payment data, and data belonging to minors or other protected classes — may be more sensitive than others, and subject to varying regulations.
Consider a social media platform that caters to both children and adults, and which collects data from both of these user segments. Data collection related to children and minors is often subject to stricter limitations and requirements compared to data collection related to adults.
With this in mind, it’s a good idea to categorize the different types of customer data that you plan to collect, and to dedicate a section of your policy to each data category.
4. Outline the specifics
Next, you’ll need to actually draft your policy. To do so, you will need to answer the following questions for each category of data you plan to collect:
What data do you intend to collect from your customers?
How long will this data be retained?
Once the retention period has ended, will data be archived or deleted?
Who should have access to each category of data?
How might the data be used?
Who is responsible for auditing customer data to ensure compliance?
Think of your data retention policy like a living document. As your business requirements or external regulations change, your policy should likewise change. Plan to review and update your data retention policy on at least an annual basis.
5. Communicate the new policy
Once you’ve created your policy, communicate it with anyone that it affects. You may, for example, share the policy with your employees to ensure compliance and to make everyone aware of their responsibilities related to protecting customer data. Likewise, you may share the policy directly with your customers or users — either because it’s required by law, or in order to promote transparency and build trust.
Getting your data retention policy right
From matters of compliance to brand reputation and customer trust, there’s a lot on the line when it comes to your company’s data retention policy. That’s especially true if you must collect sensitive customer data to support a broader identity verification or age verification strategy.
The good news is that Persona makes it easy to design and support a data retention policy that meets the expectations of both your customers and regulators. Our customers get full configurability over how they process, store, and retain data — so that they can make the right decisions according to their unique needs.
With Persona, you can:
Automatically tailor your data retention policy to different geographies, customer attributes (like age), and use cases
Automatically redact or delete information at the point of collection or after a set retention period has passed
Determine who should have access to customer data and records via granular access controls and role-based permissions
Enforce policy adherence with auditable access logs that detail what customer information is accessed when and by whom
Give customers control over their data by allowing them to prompt the deletion of their information if and when they request it
Granular access controls and role-based permissions so you can fine-tune who should have access to which systems and accounts
Ready to learn more about how Persona can help you get your data retention policy right? Request a demo today to get started.