Data Retention Policy Skill

"Keep everything forever" is a liability, not a strategy — it grows breach exposure, violates data- minimisation rules (GDPR, CCPA), and turns every data subject request into an archaeology project. This skill builds a retention schedule that ties each data category to how long you keep it and why (legal basis), with a concrete deletion trigger — so retention is a defensible policy, not an accident.

Required Inputs

Ask for these only if they aren't already provided:

• Data categories — the kinds of data you hold (customer records, logs, financial, HR, marketing, backups).
• Legal/regulatory drivers — anything mandating minimum retention (tax/financial records, employment law) or maximum (GDPR minimisation, sector rules).
• Business need — why each category is genuinely needed and for how long.
• Where it lives — systems and backups (backups are the most-forgotten place data outlives its policy).

Output Format

Data Retention Schedule: [organisation]

1. Schedule — the core table, one row per data category:

Data category	Retention period	Basis (legal/business)	Deletion trigger	Method	System(s)
Customer PII	3y after account closure	Legitimate interest + GDPR minimisation	Account closed + 3y	Hard delete	App DB, backups
Financial records	7y	Tax law (statutory minimum)	End of fiscal year + 7y	Archive then delete	Finance system

2. Principles — the policy stance: minimise by default, the shortest period that satisfies the basis, and that retention applies to backups and logs too.

3. Deletion mechanics — how deletion actually happens (automated job vs. manual), how it cascades to backups, and how it's evidenced.