Retention/Removal

Many of the data privacy regulations require that data should be retained or removed based on certain criteria:

• Legal requirements concerning financial data may stipulate the need for it to be retained for up to 10 years
• The storage limitation principle implies that Personally Identifiable Information (PII) should only be retained for the time necessary to process the data for the purpose intended or for as long as the data is in the public interest, or for research but after it has been anonymized

Figure 10.1: Files are retained until no longer needed and are then destroyed

In this chapter, we’re going to look at the privacy regulations that should be observed with regard to retention and the removal of data from your systems.

As with the chapter on privacy, in this chapter and the other T.R.I.M. chapters, the references used will be to the GDPR, CCPA, CPRA, and OECD documents that have had a strong influence in...