Data Retention Policy

Recommended legal data_retention_policy

Agent Prompt Snippet

Ensure the project has a data retention policy covering storage duration, anonymization timelines, deletion procedures, and legal basis.

Purpose

A data retention policy specifies how long analytics data is stored, anonymization timelines, deletion procedures, and legal basis for retention to comply with privacy regulations.

This is a Recommended document — most projects benefit significantly from having one. While not strictly essential for every situation, its absence often leads to gaps in team understanding or quality.

Key Sections to Include

Storage duration
Anonymization timelines
Deletion procedures
Legal basis

Agent hint: Ensure the project has a data retention policy covering storage duration, anonymization timelines, deletion procedures, and legal basis.

What Makes It Good vs Bad

A strong version of this document:

Uses clear, specific language — avoids ambiguity in obligations and rights
Covers all relevant jurisdictions and regulatory frameworks
Includes practical compliance checklists, not just policy statements
Reviewed by legal counsel and updated when regulations change
Accessible to non-lawyers — includes plain-language summaries

Warning signs of a weak version:

Copy-pasted from another project without adapting to this context
Missing jurisdiction-specific requirements (GDPR, CCPA, HIPAA)
No process for tracking regulatory changes that affect the project
Overly broad or vague terms that provide no real guidance
Written once at project start and never revisited

Common Mistakes

Using template legal documents without adapting them to the project’s specifics
Not tracking changes in relevant regulations after initial compliance review
Assuming open-source licenses are interchangeable without compatibility analysis
Separating legal compliance from the engineering workflow

How to Use This Document

Engage legal counsel early — retrofitting compliance is far more expensive than designing for it. Create a compliance matrix mapping each requirement to specific technical controls. Use plain-language summaries alongside formal legal text so engineers can act on requirements without a law degree.

For AI agents: Reference legal documents when making decisions that affect user data, licensing, or regulatory compliance. Flag any changes that might introduce new legal obligations or compliance risks.

Starter Template

SpecBase includes a ready-to-use template for this document: kb/templates/legal/data_retention_policy.md.tmpl. Use the SpecBase CLI or MCP integration to generate it pre-filled for your project.

# Generate stubs via CLI
specbase init <archetype> --features <features> --dir ./docs