A data retention policy is a set of established rules that dictates how long specific types of information must be kept and the procedures for its eventual disposal. The scenario describes a classic example of such a policy: court files (a type of data) must be stored for a specific period (ten years) and then follow a disposition process (be discarded). This policy ensures compliance with legal, regulatory, or business requirements for record-keeping. The scanning for permanent reference and the defined storage duration are core components of managing the data lifecycle according to a retention policy.

A. Data loss prevention: This focuses on preventing the unauthorized exfiltration, destruction, or leakage of data, not on defining the required storage duration for compliance or business needs.

C. Data classification: This is the process of categorizing data based on its sensitivity (e.g., public, confidential). While classification informs retention rules, it is not the policy that defines the storage timeline itself.

D. Global regulations: While regulations (which may or may not be global) often mandate retention periods, the concept that directly applies to the implementation of these rules within an organization is the data retention policy.

1. ISO 15489-1:2016

Information and documentation — Records management — Part 1: Concepts and principles. Section 9.2

"Retention and disposition

" specifies that processes should be established to determine the length of time records are to be kept to meet business

legal

and other requirements. This directly describes the function of a data retention policy.

2. National Institute of Standards and Technology (NIST) Special Publication 800-88 Rev. 1

Guidelines for Media Sanitization. Section 2.2

"Data Disposition

" states

"The decision to dispose of information is based on the organization’s records retention schedule... A records retention schedule details how long information should be retained based on a classification scheme and identifies the final disposition of the information (e.g.

transfer or destruction)."

3. Cornell University

University Policy 5.4.2

Data Retention. The policy states

"University data must be retained for specific periods of time to comply with legal

audit

and other university requirements... At the end of the required retention period

the data must be disposed of in a secure manner." This university policy document exemplifies the concept in practice.