{"id":516137,"date":"2024-06-05T16:25:35","date_gmt":"2024-06-05T20:25:35","guid":{"rendered":"https:\/\/www.commvault.com\/?post_type=cmv_glossary&p=516137"},"modified":"2024-06-05T16:25:36","modified_gmt":"2024-06-05T20:25:36","slug":"data-retention-policy","status":"publish","type":"cmv_glossary","link":"https:\/\/www.commvault.com\/glossary-library\/data-retention-policy","title":{"rendered":"Data Retention Policy"},"content":{"rendered":"\n
\n\t
\n\t\t
\n\t\t\t
\n\t\t\t\t
<\/div>\n\t\t\t<\/div>\n\t\t<\/div>\n\t\t
\n\t\t<\/div>\n\t\t
\n\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\n\n

Definition<\/h2>\n\n\n\n

An organization\u2019s data retention policy is a set of rules that describe the types of data that will be retained by the entity and for how long. Retention policies also address how the data is handled at the end of the retention period when companies explore options ranging from doing nothing to destroying the data or archiving it. 

Data retention policies are adopted to achieve and maintain compliance with relevant regulatory requirements. For example, if an organization takes part in a regulated industry where data must be preserved for seven years, the company retention policy must specify and enforce the specified seven-year retention period. <\/p>\n\n\n\n

An example of a retention policy article would be \u201cretain daily backup for seven calendar days.\u201d <\/p>\n\n\n\n

What is a data retention policy? <\/h2>\n\n\n\n

In addition to the above description, organizations must adhere to the international, regional and industry standards that govern areas where an enterprise has customers or does business. Besides the imperative to retain data for a specified length of time, data location has become extremely important and is now a permanent fixture in data retention policies. For example, the European Union\u2019s General Data Protection Regulation (GDPR) rules require that EU citizens\u2019 data be stored within the EU borders. <\/p>\n\n\n\n

In addition, some industries also come with retention requirements. Companies tend to adopt data retention policies that exceed prevailing regulatory requirements. That is especially true in regulated industries such as healthcare and financial services. For example, companies that do business in the healthcare sector, one of the unique regulatory requirements is the Health Insurance Portability and Accountability Act (HIPAA)<\/a>, which governs healthcare data, and there are requirements around how long HIPAA documentation must be retained, while states govern medical record retention requirements.(1) Also, companies that operate in the United States must adopt Sarbanes-Oxley Act (SOX) <\/a> compliant data retention policies. <\/p>\n\n\n\n

An essential aspect of data retention policies is to keep the more expensive primary storage free for frequently accessed data. To that end, enterprises set and enforce policies that move data at the end of their retention period to cheaper secondary or tertiary storage. These storage tiers could be less expensive on-premises disk storage, tape or even cloud storage. The most common storage tiers for secondary and tertiary copies are cloud storage. Cloud storage<\/a> also offers customers different tiers or levels of storage depending on the data retention requirements. Cloud storage could be considered hot, cold or archive to offer customers different cost structures for their data retention policies. <\/p>\n\n\n\n

What should be included in a data retention policy? <\/strong><\/h2>\n\n\n\n

As noted earlier, a retention policy helps companies manage important data per rules and regulations that govern their business and the locale where they operate. <\/p>\n\n\n\n

A robust data retention policy would include: <\/p>\n\n\n\n