Skip to content

Retention Schedule

A governing policy artifact — instantiates Layer Decay and Expiration Management

The governing table that assigns every class of record a mandated lifespan — how long it must be kept and when it must go — with legal holds that can override the clock.

Most disposition mechanisms decide how to remove or relocate a layer; Retention Schedule decides, by policy, how long each class of layer is even allowed to exist. It is the authoritative rule-book that maps record categories — contracts, tax filings, HR files, emails, telemetry — to mandated retention periods and disposition actions, grounded in law, regulation, and business need rather than in age or access alone. Its defining feature is that it works at the level of classes governed by obligation, not individual items scored by value: an invoice isn't kept because it's frequently accessed but because a regulator says seven years, then dispose. It also carries the crucial escape hatch — a legal hold that freezes the clock and forbids disposal regardless of schedule. It is the source of authority the other mechanisms enforce.

Example

A company's Retention Schedule is a matrix: tax records → keep 7 years then destroy; signed contracts → keep 6 years after expiry; routine internal email → keep 18 months then auto-delete; safety incident reports → keep permanently. When an ordinary email crosses 18 months, the schedule authorises its deletion and a cleanup job carries it out. But when litigation is filed touching a project, the general counsel places a legal hold on all related records; the schedule's preservation register now overrides every deletion clock — those emails and contracts are frozen and cannot be purged even past their normal expiry, until the hold lifts. The same record is deletable by default and undeletable under hold, and the schedule is what encodes both states and the authority behind them.

How it works

Its substance is the class-to-obligation mapping plus the override register, not any removal machinery:

  • Build a retention matrix: record class → minimum keep period → maximum keep period → disposition action, each cited to its legal or business basis.
  • Register preservation exceptions — categories or specific items marked keep-longer or keep-forever for historical, safety, or evidentiary reasons.
  • Encode legal holds / compliance overrides that suspend the disposal clock for named records the moment a hold is issued, and release them when it lifts.
  • Publish the schedule as the authority that value scores, TTLs, and cleanup jobs must obey — it grants and withholds permission to dispose.

Tuning parameters

  • Class granularity — how finely records are categorised. Fine classes fit obligations precisely but are costly to maintain and to map every layer onto; coarse classes are simple but over- or under-retain.
  • Minimum vs. maximum retention — whether a class has only a floor (keep at least), a ceiling (destroy by), or both. Ceilings matter where over-retention is itself a liability.
  • Default rule — what happens to an unclassified layer: keep-forever (safe but hoards) or dispose-after-default (tidy but risky). This governs the long tail of unlabelled data.
  • Hold scope and precedence — how broadly a legal hold sweeps and how it interacts with normal schedules; over-broad holds freeze far more than the matter requires.
  • Review interval — how often the schedule is revisited against changing law, since an out-of-date matrix authorises the wrong disposals.

When it helps, and when it misleads

Its strength is that it supplies legitimate authority to the whole lifecycle: it is the difference between deleting on a whim and disposing on a defensible, documented obligation, and it is the only mechanism that can both compel keeping (holds, minimums) and compel destruction (maximums). It turns compliance from ad-hoc into systematic.

Its failure modes are governance ones. A schedule that only ever adds "keep longer, just in case" mutates into keep-everything-forever, defeating the point and building the exact liability that mandated maximum retention exists to prevent. Legal holds, if never released, silently ossify huge swaths of data into permanence. And a schedule is only paper unless enforced — an elegant matrix that no mechanism actually executes is theatre. Its classic misuse is retro-fitting the classes so that whatever someone already wanted to delete happens to be "eligible." The discipline is to enforce maximums as seriously as minimums, to scope and release holds deliberately, and to review the matrix against current law on a real cadence.[1]

How it implements the components

Retention Schedule realises the governance-and-authority side of the archetype — what layers may live, how long, and when they must not be touched:

  • retention_policy_matrix — the core artifact: the class → lifespan → disposition table itself.
  • preservation_exception_register — the record of categories and items marked keep-longer or keep-forever against the default clock.
  • legal_hold_or_compliance_override — the mechanism by which a hold suspends the disposal clock for named records regardless of schedule.

It does not compute a layer's individual worth (that's Age-Weighted Value Score), nor carry out any removal — the Log Rotation and Cleanup Job, Cache Eviction Rule, and Time-to-Live (TTL) Policy enforce the disposals this schedule authorises.

Notes

The schedule is authority, not action: it says a layer may or must be disposed, but something else does the disposing. This separation is deliberate — it lets the obligation rules be audited and updated by records and legal staff without touching the enforcement machinery, and it means a legal hold can freeze disposal instantly across every enforcing mechanism at once.

References

[1] A records retention schedule with a legal hold override is standard records-and-information-management practice; regimes such as data-protection storage-limitation rules and financial record-keeping mandates set both minimum and maximum periods. The concepts are used as-is, not as a cited authority. ↩