Lion Cipher Lab

Build a data retention and disposal schedule you can defend row by row

• GRC / Compliance
• Intermediate
• ~75 min
• Free · no account required

Why it matters

Almost every organisation is caught between two forces pulling data in opposite directions, and a data retention and disposal schedule is the single artifact that reconciles them on paper, in a way you can defend. On one side are reasons to KEEP data: tax law says hold financial records for years, employment law sets minimum periods for payroll, an auditor wants the logs, and the moment a dispute looks likely a legal hold freezes everything relevant. On the other side are reasons to DELETE it: privacy law's storage-limitation principle says you may not keep personal data longer than the…

What you'll learn

• defining the vocabulary of the data lifecycle from zero: retention period, retention schedule, disposal/sanitization, storage limitation, legal hold (litigation hold), data category, retention trigger, and the difference between a 'record' and transient data
• framing retention as the reconciliation of two opposing pressures -- reasons to KEEP data (legal/regulatory duty, audit, active litigation hold, genuine business need) versus reasons to DELETE it (privacy storage-limitation, smaller breach blast radius, lower e-discovery and storage cost)
• inventorying six to eight real data categories (customer PII, payroll/HR, security/audit logs, email, marketing contacts, backups, financial/tax records, CCTV) with an owner, a storage location, and a sensitivity for each
• assigning a retention period to each category with a DEFENSIBLE justification -- a specific statutory/regulatory citation, a documented business need, or a storage-limitation rationale -- while understanding that periods vary by jurisdiction and must be mapped to your own obligations
• adding the retention TRIGGER (the event that starts the clock: end of employment, last transaction, account closure) so a period is actionable rather than a floating number
• matching a DISPOSAL METHOD to media and sensitivity: crypto-erase for encrypted-at-rest data, NIST SP 800-88 clear/purge/destroy for drives, and secure shredding for paper
• writing the LEGAL-HOLD override into every row, and understanding that a hold TRUMPS the schedule -- deleting data under hold is spoliation
• mapping the finished schedule to the controls it satisfies -- NIST SP 800-53 SI-12 (and SI-12(1)/(3) for PII limitation, minimisation and disposal), ISO/IEC 27001:2022 records-protection and secure-deletion controls, and GDPR Article 5(1)(e) storage limitation plus Article 17 right to erasure -- so the schedule becomes the EVIDENCE
• reasoning honestly about the hard cases: enforcing the schedule with automated TTL/lifecycle rules AND disposal evidence, reconciling immutable/ransomware-proof backups against erasure requests, and treating over-retention as a risk in its own right

Steps in this lab

1. The two opposing pressures — and the words you need before you start
2. Inventory the data categories — with owner, location, and sensitivity
3. Assign a retention period — with a justification you can cite
4. Add the trigger, the disposal method, and the legal-hold override
5. Assemble the full schedule — the defensible artifact (and a template)
6. Map the schedule to the controls it is evidence for
7. The honest negatives — a schedule nobody enforces is theatre
8. Do it better — make it living, and use it as a blast-radius reducer

Open the full interactive lab →