Step Five Align Data Retention Policies

Today’s data-driven economy incentivizes businesses to collect and hold more data for some future possible value. These inclinations conflict with the principle of data minimization enshrined in the GDPR, CCPA 2.0, and other modern privacy and data protection frameworks. For example:

• GDPR Article 5©: “Personal data shall be adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed (‘data minimization’)”
• CCPA/CPRA § 1798.100©: “A business’s collection, use, retention, and sharing of a consumer’s personal information shall be reasonably necessary and proportionate to achieve the purposes for which the personal information was collected or processed…”.
• Virginia CDPA § 59.1-578(A):: “Personal data processed by a controller… may be processed to the extent that such processing is reasonably necessary and proportionate to the purposes listed in this section; and Adequate, relevant, and limited to what is necessary in relation to the specific purposes.”

Applying data minimization is an essential part of privacy by design. Data minimization is the way by which you step back and ask, “What data is essential to collect? When? What’s meaningful to keep? For how long?”

• Business value: Knowing what information is critical to your business activities, and when to collect it positions your business to use data more efficiently. Work across your organization to arrive at sensible, minimally viable baselines. Payroll needs personal bank account numbers, Marketing doesn’t.
• Complexity as risk multiplier: Reducing the sheer volume and variety of collected personal data reduces oversight complexity. Less information means less storage and backup overhead. It also means being a smaller target for cybercriminals.
• Consumer expectations: Consumers expect companies to use their data for the purposes for which it was originally collected, or for closely related purposes.
• Retention obligations: Businesses have various legal retention obligations depending on the industry they operate in. Banking, financial record integrity, tax, and labor laws can prescribe minimum as well as maximum retention periods. Contractual agreements between businesses can also stipulate minimum/maximum periods.

Regularly reviewing your data practices against business needs and retention commitments is par for the course. This step protects your company against significant data accumulation and ensures your organization thinks about its data lifecycle, from collection to destruction.

Privacy teams should work with Legal to understand applicable retention requirements, and to document these parameters in a data retention policy & schedule.

Check Out the Data Retention Policies of Top Tech Companies

Google

Apple

Right-sizing your collection and retention practices can translate to other privacy operational efficiencies. For example, the CCPA 2.0’s right of access has an expansive "look-back provision." To respond to an Access request, organizations need to know the personal information they collected, used, sold, or shared about an individual going back 12 or more months from the time of the verified request. When combined with CCPA 2.0’s data minimization and collection limitation requirements, there’s an incentive for California businesses to trim their data footprint.