Policy template

Data Retention Policy template

This policy exists to ensure records are kept as long as required and securely deleted afterwards. It applies to all records and data held by the company, in any format and location.

Create this policy

What the policy contains

Retention schedule
Deletion

Who is responsible

Record owners
IT Manager
Information Security Manager

What you decide

Retention schedule reviewedQuarterly · Every 6 months · Yearly
Deletion methodsSecure wiping · Shredding · Physical destruction of media · Cryptographic erasure

References covered

ISO/IEC 27001 Annex A: control 5.33
ISO/IEC 27001 Annex A: control 5.34
ISO/IEC 27001 Annex A: control 8.10
GDPR: Art. 5(1)(e) storage limitation
GDPR: Art. 17 right to erasure

Other policy templates

Clear Desk & Clear Screen Policy
Cryptography & Encryption Policy
Logging & Monitoring Policy
Vulnerability Management Policy
Acceptable Use of AI Policy
Project Management Policy