Data retention policies define how to organize, maintain, and archive the information in your possession. They also outline how and when to dispose of information. Different types of data must be retained for different lengths of time, depending on legal and business requirements. Most data retention policies also address how to handle information involved in litigation.

When youre creating a data retention policy, you need to identify the various types of data your organization uses. Develop a policy that defines how long each type of data should be retained, as well as how it should be destroyed when the retention time expires.

Its extremely important to record this information explicitly in a policy thats written clearly. Having a written policy, and ensuring that everyone in the organization follows it, will help protect you from accusations of evidence tampering.

• Describe how data retention policy protects a security professional in any organization.
• Discuss data retention rules on how long the any organization should hold on to emails and tax documents.
• Discuss why using classification labels can help identify data.