Why retention policies exist

GDPR, CCPA, and sector-specific regulations (HIPAA, FINRA) require data to be deleted after it is no longer needed. Keeping data indefinitely is a liability, not an asset.

Define retention by data class

  • Transactional data (orders, payments): typically 7 years for financial compliance.
  • User activity / behavioural data: 2 years is common unless there is a specific need.
  • Logs: 90 days online, 1 year cold, then delete.
  • Marketing data: follow consent duration.

Technical implementation

-- Automated deletion job (runs nightly)
DELETE FROM user_events
WHERE created_at < NOW() - INTERVAL '2 years'
  AND user_id NOT IN (SELECT id FROM active_legal_holds);

For S3, set lifecycle rules per prefix: Expiration: Days: 730.

Audit trail

Log every deletion with timestamp, table, row count, and the policy that triggered it. Regulators may ask for evidence that deletion occurred.