Lion Cipher Lab
Build a records retention and defensible-deletion schedule
- GRC / Compliance
- Intermediate
- ~45 min
- Free · no account required
Why it matters
Almost every organization answers 'how long should we keep this?' the same way: forever, by default, because deleting takes effort and nobody wants to be the person who threw away the file that was later needed. That default feels safe and is quietly one of the most expensive mistakes in data governance. Every record you keep past the point it serves a purpose is a record that can be breached, must be searched and produced in a lawsuit, and — if it is personal data — may itself be a legal violation, because privacy law (the EU's GDPR, Article 5) requires that personal data not be kept longer…
What you'll learn
- explaining in plain words what a records retention schedule is: a table that says, for each kind of record, how long you keep it, why, when the clock starts, and how you get rid of it when the time is up
- defining the vocabulary cold — a record, a retention period, a retention DRIVER (the law/regulation/business reason that sets the period), a trigger event, disposition, a legal hold, and GDPR 'storage limitation'
- building the schedule as a real artifact: a CSV with a row per record category (HR, financial/tax, security logs, customer PII, email, contracts) and columns for period, driver, trigger, disposition, and legal-hold exception
- operationalizing DEFENSIBLE DELETION: deleting on schedule as a deliberate, documented, routine act — and being able to SUSPEND that deletion instantly when a legal hold lands
- the reframe that separates a pro from a hoarder: data kept past its purpose is a LIABILITY, not an asset — it enlarges breach blast radius, violates GDPR storage limitation, and runs up e-discovery cost
- MEASURING the schedule concretely: % of categories with a defined period AND a cited driver (0% -> 100%) and the count of 'keep forever' categories (the risk, driven to 0), tallied from the CSV with a tiny Python stdlib script
- the judgment calls: when a longer period is required vs. merely convenient, why the shortest defensible period usually wins, and how legal hold legally overrides the schedule
- the hard truth that a schedule only works if ENFORCEMENT exists — automated deletion wired to the trigger — otherwise 'delete after 90 days' is a sentence in a document while the data lives forever
Steps in this lab
- From zero: what a retention schedule is, and the words it runs on
- The reframe: why keeping data forever is a liability, not an asset
- Meet the sample company and its six record categories
- Build the schedule: fill all five columns for all six categories
- Operationalize defensible deletion and the legal-hold override
- Measure it: coverage from 0% to 100% and keep-forever to zero
- The honest negative: a schedule is only as good as the enforcement behind it
- Judgment: what to keep, and the mistakes that kill schedules