Data Retention & Deletion
Personal data must not be kept longer than necessary. This workshop turns the RoPA retention periods into a retention schedule, defines how data is deleted and carries out the first review.
Workshop 6 video
Walkthrough of the workshop and its tasks — coming soon
Workshop tasks
-
1. Create the retention schedule
Start from the RoPA periods, check legal obligations (tax, accounting, employment) and define the event that starts each period.
In ResGuard: Data Inventory -
2. Deletion & anonymisation methods
Define per system how data is deleted: automatic rules, manual steps with an owner, anonymisation, backups and secure destruction of paper.
-
3. Set up reviews
Appoint owners per department and repeat the reviews at least every six months. ResGuard sends automatic reminders.
In ResGuard: Retention Review -
4. First retention review
Find data that is already past its retention period, including shared folders and old mailboxes, check for exceptions and delete it.
In ResGuard: Retention Review -
5. Legal holds & exceptions
Define how deletion is suspended for litigation, inspections or audits, who orders it and how it is lifted.
In ResGuard: Policy Framework -
6. Workshop review & close-out
Review the results, attach evidence and close the objective in ResGuard.
In ResGuard: Objective Manager
What to keep in mind in Peru
- Check the retention periods required by Peruvian tax, employment and sector rules before setting your own periods.
- When you delete data, also update the database registration if its content changes.
Expected result
- Retention schedule approved
- Deletion methods defined per system
- Retention reviews set up in Retention Review
- First review carried out and documented
ResGuard modules: Retention Review, Data Inventory (RoPA), Policy Framework