Retention, Deletion, Archiving and Data Events

What it is

Retention policy decides how long data is kept, how it is archived and how it is destroyed, with legal hold suspending deletion when litigation or investigation requires it.

Auditability of data events means recording who did what to which data, when and from where, so that actions can be traced to an accountable identity and the records can stand up as evidence.

How it works

Data retention policies

A retention policy states, for each category of data:

• The retention period, based on law, regulation, contract and business need.
• The format and storage location, including permitted regions.
• The archiving method and required retrieval time.
• The destruction method at the end of the period.
• Roles: who owns the schedule and who approves exceptions.

Keeping data too long is also a risk. It increases breach impact and breaks data minimization rules such as those in GDPR.

Data deletion procedures and mechanisms

Deletion procedures should list every copy: replicas, snapshots, backups, caches, logs and exports to third parties. Contracts should say how long the provider keeps deleted data and confirm destruction at exit.

Data archiving procedures and mechanisms

An archive must remain readable for the whole period. Plan for:

• Format: open, durable formats that will still open in years.
• Encryption and keys: keys retained and escrowed as long as the data.
• Technology: archival storage tiers have slower retrieval; confirm retrieval times meet legal requests.
• Integrity: hashes or write once storage to prove the archive is unchanged.
• Testing: periodic restores to prove the archive can actually be read.

Legal hold

A legal hold preserves data that may be relevant to litigation, investigation or regulatory inquiry. It overrides normal retention and deletion schedules until legal counsel releases it.

• Deletion prevention: automatic expiry and lifecycle deletion are suspended for held data, often using retention locks.
• Authorized access: only named legal and investigation staff may access held data, with every access logged.
• Scope: the hold covers all copies and locations, including SaaS and backups.

Deleting data after a hold notice can be spoliation of evidence, with serious legal consequences.

Event sources and attributes

Data events come from storage access logs, database audit logs, management plane logs (who changed a policy or key), SaaS audit logs, IAM and key management logs. The customer must know which sources each service category exposes; SaaS often offers far fewer than IaaS.

Each event should capture the attributes needed to answer who, what, when, where and outcome:

{"time":"2026-10-20T09:14:03Z","identity":"svc-reporting","source_ip":"203.0.113.24","geo":"DE","action":"object.read","object":"hr/payroll-2026-09.csv","result":"success"}

Logging, storage and analysis

Send logs to a central store outside the account being logged, protect them from alteration with write once storage or hashing, keep them for the required period, and analyse them in a SIEM. Clocks must be synchronized, or events cannot be correlated.

Chain of custody and non-repudiation

Chain of custody documents who collected evidence, when, how, where it was stored and every transfer. Non-repudiation means an actor cannot credibly deny an action, which requires strong authentication, unique identities (no shared accounts), integrity protected logs and, for documents, digital signatures.

A worked example

A logistics company receives a litigation notice about a customer dispute. Its policy deletes customer emails after two years, and the relevant emails are 23 months old.

Legal counsel issues a hold. The SaaS email retention lock is applied to the named mailboxes, overriding the deletion policy. Investigators get read access, every access is logged, and exported copies are hashed and recorded in a chain of custody form.

How the exam asks about this

• "Litigation is expected and a retention policy would delete relevant records next week. What should happen?" Apply a legal hold to suspend deletion.
• "Which practice BEST supports non-repudiation of data changes?" Unique authenticated identities with integrity protected logs, never shared accounts.
• "Why must log timestamps be synchronized?" So events from different sources can be correlated into an accurate timeline.