Data retention policy

A data retention policy is a documented rule for how long a given category of data is kept before it is deleted, anonymized, or archived, and it typically varies by data type: transaction records might be kept for years for financial reporting, while raw clickstream logs might be purged after weeks or months. The policy also usually specifies where and how deletion happens, since data copied into backups, caches, or downstream systems needs its own retention rule.

Retention policies are shaped by two forces pulling in different directions: regulations like General Data Protection Regulation and California Consumer Privacy Act that limit how long personal data may be kept beyond its original purpose, and business or legal needs that require keeping certain records for a minimum period, such as financial audit trails. Retention is usually organized around a data classification scheme, since different categories of data carry different retention obligations and risks.

Retention matters for analytics because it directly limits what history is available to analyze, a churn model trained on data only two years deep behaves differently from one trained on five, and because keeping data indefinitely "just in case" increases the surface area of a potential breach and can itself violate policy. It falls under data governance and involves personally identifiable information most directly; specific retention periods depend on the applicable law, industry, and data type rather than a single universal rule.