markus41 Data Retention and Deletion Policy Design
Design a complete data retention and deletion policy covering inventory, regulatory minimums, retention schedule, legal hold procedures, deletion runbook, and technical implementation guidance.
Step 1: Data Inventory
Identify and classify all data types the client holds. For each, document:
| Data Category | Subcategory | Format | Storage Location | Contains PII? | Regulatory Category |
|---|---|---|---|---|---|
| Customer PII | Contact info | DB records | CRM, AMS, LOS | Yes | GLBA, state privacy |
| Customer PII | SSN/Tax ID | Encrypted DB | Core system | Yes — sensitive | GLBA, FCRA |
| Transactions | Policy premiums | DB records | AMS | Yes | State DOI |
| Transactions | Loan origination | DB + documents | LOS + file storage | Yes | RESPA, TRID |
| Communications | Email correspondence | Email archive | Exchange/O365 | Maybe | FINRA 4511, state |
| Communications | Recorded calls | Audio files | Call recording platform | Maybe | State recording law |
| Audit logs | System access | Log files | SIEM | Partial | SOX, SOC 2 |
| Financial records | Ledger entries | DB records | Accounting system | No | SOX, tax |
| Documents | Applications | PDF/scanned | Document management | Yes | Varies by type |
| Documents | Policy/loan docs | Document management | Yes | State DOI, RESPA | |
| Documents | Adverse action notices | Document management | Yes | ECOA, FCRA | |
| Claims records | FNOL and adjuster notes | DB + docs | Claims system | Yes | State DOI |
| Marketing | Prospect data | CRM | CRM | Yes | CCPA, CAN-SPAM |
| HR | Employee records | HR system | HRIS | Yes | State labor law |
Step 2: Regulatory Minimum Retention by Data Type
Insurance
| Record Type | Minimum Retention | Clock Starts | Citation |
|---|---|---|---|
| Policy files (all lines) | 5 years | Policy expiration | Most state DOI regulations |
| Policy files (life insurance) | 6 years | Policy expiration | Many states — use most restrictive |
| Claims files | 5 years | Claim closure | State DOI (varies; verify per state) |
| Agent licensing records | 3 years | License termination | NAIC Producer Licensing Model Act |
| Market conduct records | 5 years | Record creation | State DOI market conduct exams |
| Premium tax records | 4 years | Tax filing | State DOI / state revenue dept |
| Complaint records | 5 years | Complaint closure | Most state DOI regulations |
| Advertising/marketing materials | 3 years | Last use | State DOI unfair trade practices |
| Surplus lines affidavits | 3–5 years | Filing date | State surplus lines law (varies) |
Mortgage
| Record Type | Minimum Retention | Clock Starts | Citation |
|---|---|---|---|
| Loan application and disclosures | 3 years | Consummation or action taken | Reg Z § 1026.25 |
| TRID Loan Estimates and CDs | 3 years | Consummation | Reg Z § 1026.25(c) |
| RESPA servicing records | 2 years | Date of action | Reg X § 1024.38 |
| HMDA Loan Application Register | 3 years | LAR submission | Reg C § 1003.5(b) |
| ECOA adverse action notices | 25 months | Date notice given | Reg B § 1002.12 |
| FCRA adverse action notices | 5 years | Date notice given | FCRA § 1681p |
| BSA/AML Currency Transaction Reports | 5 years | Filing date | 31 CFR 1010.430 |
| BSA/AML Suspicious Activity Reports | 5 years | Filing date | 31 CFR 1020.320 |
| BSA Customer Identification records | 5 years | Account closure | 31 CFR 1020.220 |
| QM/ATR income/asset documentation | 3 years | Consummation | Reg Z § 1026.43(e)(4) |
| MERS registration records | Life of loan + 7 years | Payoff/transfer | MERS operating procedures |
Financial Services / General
| Record Type | Minimum Retention | Clock Starts | Citation |
|---|---|---|---|
| FINRA customer account records | 6 years | Account closure | FINRA Rule 4511 |
| FINRA communications (general) | 3 years | Creation (first 2 years easily accessible) | FINRA Rule 4511 |
| FINRA order tickets | 3 years | Order date | FINRA Rule 4511 |
| SEC investment advisor records | 5 years | Creation | 17 CFR 275.204-2 |
| SOX financial records | 7 years | Fiscal year end | SOX § 802 |
| Tax records | 7 years | Tax filing | IRS general guidance |
| GLBA privacy notices | 6 years | Issuance | 16 CFR Part 314 |
| Employment records | 4–7 years | Employment end | State labor law (varies) |
Step 3: Retention Schedule
Build the master retention schedule combining regulatory minimums with business requirements. Apply the most restrictive applicable period.
Retention period table format:
| Data Category | Business Minimum | Regulatory Minimum | Regulatory Citation | Approved Maximum | Active Storage | Archive Storage | Delete Action |
|---|---|---|---|---|---|---|---|
| [Category] | [N years] | [N years] | [Citation] | [N years] | [N years] | [N years after archive] | [Auto-delete / Manual review / Anonymize] |
Approved maximum = the point at which data must be deleted absent a legal hold. Typically regulatory minimum + 1–2 years buffer for litigation.
Step 4: Legal Hold Procedures
When litigation, regulatory investigation, or government inquiry begins, standard retention schedules are suspended for affected data.
Legal hold process:
- Trigger identification — Litigation hold triggers: receipt of subpoena, preservation letter, or when litigation is reasonably anticipated
- Hold notice — Legal counsel issues written hold notice to all custodians of potentially relevant data
- System hold flags — IT sets a legal hold flag on affected records in all systems; automated deletion is blocked for flagged records
- Custodian acknowledgment — All recipients of hold notice confirm in writing
- Scope documentation — Hold notice specifies: data categories in scope, date range, relevant systems, custodians
- Hold log — Maintain a log of all active legal holds: matter name, date issued, data scope, custodians, systems
- Hold release — Legal counsel issues release notice when matter is resolved; IT removes hold flags; standard retention schedule resumes
- Periodic review — Active holds reviewed quarterly to confirm continued necessity
Step 5: Deletion Runbook
For each data category at end of retention period:
Automated deletion (preferred for structured data):
1. Automated job runs [daily / weekly / monthly]
2. Query: SELECT records WHERE retention_expiry_date <= TODAY() AND legal_hold_flag = FALSE
3. For PII: overwrite with zeros or cryptographically erase encryption key (key deletion)
4. For non-PII: standard delete + transaction log purge
5. Generate deletion certificate: timestamp, record count, data category, deletion method, operator
6. Log deletion certificate to immutable audit log
7. Alert to compliance officer if deletion count exceeds threshold (potential pipeline issue)
Manual review deletion (for complex or high-value records):
- System generates deletion candidate list 60 days before expiry
- Compliance officer reviews list; approves or applies legal hold extension
- Approved deletions executed by IT with certificate generated
- Certificate filed in compliance records
Backup and archive purge:
- Backup media must be included in retention/deletion scope
- Backups older than retention period must be purged on the same schedule
- For tape backups: overwrite-3-pass standard (NIST SP 800-88)
- Cloud backups: confirm provider's deletion API deletes all copies including geo-redundant replicas
- Certificate of destruction issued by vendor for physical media destruction
Anonymization (alternative to deletion where operational data is needed):
- Replace PII fields with synthetic values or hash
- Anonymized records are no longer subject to privacy law retention limits
- Confirm anonymization is truly irreversible before classifying as complete
Step 6: Technical Implementation Notes
Database:
- Add
retention_expiry_datecolumn to all tables containing regulated data - Add
legal_hold_flagboolean column - Create deletion job with idempotent design (safe to re-run)
- Index on
(retention_expiry_date, legal_hold_flag)for efficient scans
Document management:
- Set document retention metadata at upload time
- Configure automated expiry notifications 90 days before deletion
- Integrate legal hold flag with document DMS (SharePoint, Laserfiche, DocuWare)
Email/communications archive:
- Configure archiving platform (O365 Compliance, Mimecast, Proofpoint) with retention policies per mailbox category
- Legal hold: O365 Litigation Hold or In-Place Hold applied at mailbox level
Cloud storage:
- S3/Azure Blob lifecycle policies for automated tiering and deletion
- Object Lock for WORM compliance where required
- Verify deletion propagates to all storage tiers (Standard → IA → Glacier → deleted)
Output Format
Deliver three artifacts:
- Retention Schedule Table — All data categories with regulatory minimums, approved maximums, active/archive periods, and delete actions
- Legal Hold Procedure — Step-by-step process with roles, triggers, and documentation requirements
- Deletion Runbook — Automated and manual deletion procedures with certificate requirements and technical implementation notes