An information retention policy's primary purpose is to ensure that information assets are managed throughout their life cycle in a way that supports business objectives while adhering to external obligations. Business requirements dictate how long data is needed for operational, analytical, or historical purposes to generate value. Simultaneously, compliance requirements, which include laws (e.g., GDPR, SOX), regulations, and contractual agreements, mandate specific minimum and sometimes maximum retention periods. These two drivers—business need and compliance—form the foundational basis for determining appropriate retention schedules, balancing utility, risk, and cost.

B. Business storage and processing needs: These are operational and technical constraints that influence how a policy is implemented (e.g., storage costs), not the fundamental rules of what to retain and for how long.

C. Backup and restoration capabilities: These are technical mechanisms for data protection and recovery. The retention policy dictates the backup strategy, not the other way around.

D. External customer data retention requirements: This is too narrow. While a component of compliance, it ignores internal business needs and other legal requirements for non-customer data like employee, financial, or intellectual property records.

1. ISACA

CGEIT Review Manual

8th Edition (2020): Domain 2: IT Resource Optimization

Section 2.3

Information/Data. The manual explains that the information life cycle

including retention and disposal

must be managed according to business

legal

and regulatory requirements. Knowledge statement K2.4.2

"Knowledge of data/information life cycle management

" directly supports that retention periods are based on these criteria.

2. ISACA

COBIT® 2019 Framework: Governance and Management Objectives (2018): The management objective APO14 Managed Data includes the practice APO14.07 Manage data storage and archiving. This practice explicitly states the need to "Define and implement policies and procedures for data storage and archiving to meet business and compliance requirements." (p. 139).

3. ISACA

COBIT® 2019 Design Guide: Designing an Information and Technology Governance Solution (2018): Design Factor 3

"Compliance requirements

" is identified as a key factor in designing a governance system. This guide emphasizes that legal and regulatory requirements are primary inputs for I&T-related policies

including those for data retention (p. 23).