How do I install the Data Retention Auditor skill?

Run npx skillmds@latest add imtiazrayhan/data-retention-auditor in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Data Retention Auditor safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Data Retention Auditor?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Data Retention Auditor free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Data Retention Auditor?

imtiazrayhan (@imtiazrayhan) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Data Retention Auditor by imtiazrayhan

Name: Data Retention Auditor
Author: imtiazrayhan

Data Retention Auditor

Audit where personal or sensitive data is collected, copied, retained, backed up, logged, exported, and deleted, then compare actual lifecycle behavior with stated policy. Use when adding a data field, preparing a privacy review, implementing account deletion, reducing stored data, or checking whether retention controls work across primary and secondary systems.

imtiazrayhan Updated Sep 17, 2026

File contents

Trace real data copies and controls; do not infer compliance from a policy document.

Workflow

Define scope and authority. Identify data subjects, systems, environments, policy sources, contractual requirements, owners, and review boundary. Mark legal conclusions as out of scope unless supplied by qualified authority.
Inventory data elements. Classify direct identifiers, quasi-identifiers, credentials, financial or health data, content, telemetry, model inputs and outputs, and derived attributes. Record purpose and collection source.
Trace every copy. Follow writes and replication into databases, blobs, caches, queues, logs, traces, analytics, warehouses, search indexes, feature stores, exports, backups, local files, and third parties.
Map retention rules. For each copy, identify owner, purpose, legal or business basis supplied, creation time, retention clock, deletion trigger, hold or exception, and maximum duration. Flag indefinite or undocumented storage.
Inspect enforcement. Locate TTLs, partitions, lifecycle policies, deletion jobs, anonymization, key destruction, vendor APIs, and access controls. Verify whether controls apply to historical records and failure retries.
Test subject workflows. Trace access, correction, export, and deletion identifiers across aliases, tenant moves, merged accounts, and derived data. Check authorization, auditability, partial failure, retry, and completion evidence.
Handle backups honestly. Document backup retention, restore implications, deletion propagation after restore, and access restrictions. Do not claim immediate erasure when recovery copies persist under a defined lifecycle.
Verify with samples and metrics. Use safe synthetic or authorized records to test expiry and deletion. Require counts of eligible, processed, failed, overdue, and restored records without exposing sensitive values.

[!WARNING] Do not copy real sensitive values into the audit report. Reference systems, fields, record identifiers approved for audit, and aggregate evidence.

Output

Provide a data inventory and lineage matrix, policy-to-control mapping, retention and deletion gaps, backup and vendor caveats, workflow test evidence, prioritized remediation, owners, and unresolved questions requiring privacy or legal judgment.

---name: data-retention-auditordescription: Audit where personal or sensitive data is collected, copied, retained, backed up, logged, exported, and deleted, then compare actual lifecycle behavior with stated policy. Use when adding a data field, preparing a privacy review, implementing account deletion, reducing stored data, or checking whether retention controls work across primary and secondary systems.---Trace real data copies and controls; do not infer compliance from a policy document.## Workflow1. **Define scope and authority.** Identify data subjects, systems, environments, policy sources, contractual requirements, owners, and review boundary. Mark legal conclusions as out of scope unless supplied by qualified authority.2. **Inventory data elements.** Classify direct identifiers, quasi-identifiers, credentials, financial or health data, content, telemetry, model inputs and outputs, and derived attributes. Record purpose and collection source.3. **Trace every copy.** Follow writes and replication into databases, blobs, caches, queues, logs, traces, analytics, warehouses, search indexes, feature stores, exports, backups, local files, and third parties.4. **Map retention rules.** For each copy, identify owner, purpose, legal or business basis supplied, creation time, retention clock, deletion trigger, hold or exception, and maximum duration. Flag indefinite or undocumented storage.5. **Inspect enforcement.** Locate TTLs, partitions, lifecycle policies, deletion jobs, anonymization, key destruction, vendor APIs, and access controls. Verify whether controls apply to historical records and failure retries.6. **Test subject workflows.** Trace access, correction, export, and deletion identifiers across aliases, tenant moves, merged accounts, and derived data. Check authorization, auditability, partial failure, retry, and completion evidence.7. **Handle backups honestly.** Document backup retention, restore implications, deletion propagation after restore, and access restrictions. Do not claim immediate erasure when recovery copies persist under a defined lifecycle.8. **Verify with samples and metrics.** Use safe synthetic or authorized records to test expiry and deletion. Require counts of eligible, processed, failed, overdue, and restored records without exposing sensitive values.> [!WARNING]> Do not copy real sensitive values into the audit report. Reference systems, fields, record identifiers approved for audit, and aggregate evidence.## OutputProvide a data inventory and lineage matrix, policy-to-control mapping, retention and deletion gaps, backup and vendor caveats, workflow test evidence, prioritized remediation, owners, and unresolved questions requiring privacy or legal judgment.

Frequently asked questions