Data Retention Schedule Template Across Privacy Laws

Schedule Columns

• Record / data set name
• System of record
• Legal / business justification
• Retention period (trigger + duration)
• Disposition (delete / anonymise / archive)
• Legal-hold override process
• Evidence of last purge job
• Owner and review date

Cross-Law Notes

• GDPR: storage limitation (Art 5(1)(e)); document criteria
• CCPA/CPRA: retention disclosures and reasonable periods relative to disclosed purposes
• PDPL regimes: follow national retention / deletion duties in implementing rules

Frequently Asked Questions

What if tax law requires longer retention?

Document the longer legal obligation; privacy storage limitation yields to conflicting legal duties when properly scoped.

Backups?

State backup cycle and residual purge timing; do not pretend instant erase of all replicas.

Who approves exceptions?

Privacy + legal + system owner; log the exception.

Related Privacy Resources

Privacy program · CSA Privacy