Specifications

Retention Schedule

Records live for a defined period, then they’re purged — not kept “just in case.”

What it ensures

Data held past its purpose is pure liability. This control purges records on their retention schedule and refuses to re-retain expired data, keeping the footprint to what policy and law allow.

It makes minimization the default rather than an occasional cleanup.

Watch it run

A set of records has passed its retention deadline — and the system is deciding what to do with them.

Illustrative run — one case moving through the Retention Schedule specification.

Retention check Within retention Purge required Purged
Permitted transition Forbidden move Start Terminal state
Records live for a defined period, then go. Holding or re-retaining data past its schedule is in red.
✕ Re-retain 1 ✓ Record 2 ✓ Retention check 3 ✓ Purged
Ready

A set of records passes its retention deadline.

  1. Ready

    Past the window

    The data has outlived its purpose and its permitted retention period.

  2. Permitted

    Expired

    A schedule, not a guess: these records are past the period policy and law allow.

  3. Blocked

    The wrong move

    Data accumulates; keeping it “just in case” is the default and the risk. Re-retaining past the schedule is refused.

    Where it comes from

    Retention limits exist because data held past its purpose is pure liability — more to breach, more to disclose, more to misuse.

    What it satisfies

    Refusing to re-retain and purging on schedule enforces the retention and disposal requirements that policy and state law impose.

    State record-retention requirements Guidance State record-retention and disposal requirements State laws and contractual obligations set how long screening records may be retained and require disposal at the end of the retention period. Requirements vary by jurisdiction and record type.
  4. Purged

    Purged

    What’s past its window is removed — not quietly kept.

  5. On the record

    The proof

    The file shows expired records were removed on time, not retained indefinitely.

Why it holds

Why the whole holds

No single cleanup keeps data minimal. What holds is that expired records cannot be re-retained — they’re purged on schedule. Reliability isn’t discipline about deleting; it’s that “keep it just in case” has no path.

Why it matters

Over-retention multiplies breach and disclosure exposure and can itself violate state retention limits; the cheapest data to protect is the data you no longer hold.