Data Lifecycle, Records and Governance

What it is

Keeping data forever is costly and risky, and deleting it too early can break the law. Data lifecycle management decides how long content is kept and what happens when the time ends. Records management goes a step further for content that must be kept as an official, unchangeable record. Data governance helps an organisation find and understand all of its data.

How it works

Retention policies

A retention policy applies keep or delete rules to whole locations at once, such as all Exchange mailboxes, SharePoint sites, OneDrive accounts and Teams chats. It can:

• Retain content for a period, so it cannot be permanently deleted before then.
• Delete content after a period.
• Retain and then delete, for example keep for seven years, then remove.

Policies work in the background. Users do not have to do anything, and they apply to everything in the chosen locations.

Retention labels

A retention label applies to an individual item, such as one document or email. It sets how long that item is kept and what happens next. Labels are made available to users, or applied automatically, using retention label policies.

If both apply to the same item, the longest retention period wins, so that content is not deleted too soon.

Records management

A record is content that must be kept as evidence, so it cannot be edited or deleted. A retention label can declare an item to be a record, which locks it. A regulatory record is stricter still, and even administrators cannot remove its label.

• A file plan organises retention labels into a structure that matches the organisation's records schedule.
• Event based retention starts the clock on an event, such as the end of a contract, instead of the date of creation.
• A disposition review asks a reviewer to confirm before content is permanently deleted at the end of its retention period, and keeps proof that it was done.

Data governance

Data governance is the ability to know and manage your data estate. The Microsoft Purview governance solutions scan data sources on premises, in multiple clouds and in software as a service apps. They build a map of the data, called the Data Map, and a catalogue that lets people find and understand data. They show data lineage, which is the path data takes from its source to where it is used, and they apply classifications automatically so that sensitive data can be found.

Which feature for which need?

A worked scenario

A company must keep financial emails for seven years and delete chat messages after two. An administrator creates a retention policy for Exchange that keeps mail for seven years and then deletes it, and a second policy for Teams chats that deletes them after two years. For signed customer contracts, a retention label that starts counting when the contract ends is published to staff, who apply it, and it marks the contract as a record, so nobody can change it. At the end of the period, a disposition review asks the legal team to approve the deletion.

When retention rules conflict

Content can be covered by several policies and labels at once. Purview resolves conflicts with a set of principles.

Event based retention

Some retention periods start at an event, not at creation. A contract might have to be kept for seven years after it ends. A retention label with event based retention waits until the end of contract event, and only then starts the seven year clock.

The data estate

An organisation's data lives in many places: files in SharePoint, databases in several clouds, and reports in software as a service tools. Data governance scans these sources and builds the Data Map, which records what each asset is, where it came from and who owns it. People can then search the catalogue instead of guessing where data is, and lineage shows which reports depend on which sources.

Making the choice