Lion Cipher Lab
Find records held past their retention period and respect legal holds
- GRC / Compliance
- Intermediate
- ~40 min
- Free · no account required
Why it matters
Most organizations have a retention schedule. Far fewer enforce it. Data accumulates in every system: applicant records from hiring rounds years ago, support tickets from customers long gone, payroll from staff who left a decade back. Every record kept past its retention period is a liability with no benefit. It enlarges the impact of any breach, it costs money to store and protect, and for personal data it can breach the GDPR's storage limitation principle, which requires that personal data be kept no longer than necessary for its purpose. Enforcement has its own hazards, though. A careless…
What you'll learn
- turning a retention schedule into an enforceable check
- retention triggers: from creation versus from closure
- legal holds and why they override deletion
- finding record types with no retention rule
- measuring what a careless purge would destroy
- verified disposal (NIST SP 800-88)
- storage limitation under GDPR
Steps in this lab
- Retention rules, triggers and holds
- The schedule and the inventory
- Write the retention scan
- Run the scan, then the careless purge
- From candidates to verified disposal