What is a Data Retention Policy?

The instinct to keep data forever "just in case" is actually a liability under most privacy frameworks - GDPR's data minimization principle expects data to be deleted once it's no longer needed for the purpose it was collected for, and holding onto it longer than necessary expands the harm surface of any future breach for no benefit. A real retention policy differentiates by data category rather than applying one blanket rule: transactional financial records might need years of retention for tax and audit reasons, while raw support chat logs might only need a few months. Each category needs its own documented retention period and a disposal mechanism that actually runs - a policy that exists only on paper but isn't enforced by an automated job isn't a control, it's an aspiration. Retention policies also interact directly with data-subject erasure requests: when a user asks to be forgotten, the retention schedule defines what can legitimately be kept anyway (e.g., records required by law) versus what must be deleted immediately.