Help us improve
Share bugs, ideas, or general feedback.
From grimoire
Creates or audits a data retention policy balancing legal obligations, business needs, and privacy requirements. Includes inventory, legal mapping, retention schedule, and deletion methods.
npx claudepluginhub jeffreytse/grimoire --plugin grimoireHow this skill is triggered — by the user, by Claude, or both
Slash command
/grimoire:design-data-retention-policyThe summary Claude sees in its skill listing — used to decide when to auto-load this skill
Create a legally compliant, operationally practical data retention policy that retains data only as long as necessary and deletes it securely on schedule.
Guides creation of data retention schedules compliant with GDPR, ISO 27001, and legal hold requirements.
Designs GDPR-compliant data retention schedules mapping data categories to retention periods with legal basis justifications, regulatory minimums, and automated review triggers. For retention policy, storage limitation, data lifecycle queries.
Defines retention rules and erasure mechanisms for LGPD compliance, reconciling right to erasure with legal retention obligations. Includes Prisma schema, strategies, and automated cleanup jobs.
Share bugs, ideas, or general feedback.
Create a legally compliant, operationally practical data retention policy that retains data only as long as necessary and deletes it securely on schedule.
Adopted by: Required by GDPR (EU), CCPA (California), HIPAA (US health), SOX (financial records), and most major data protection frameworks; ARMA International (140,000 members) is the professional standard-setting body for records management. Impact: Organizations with mature retention programs reduce data breach impact by 40% (less data at risk); reduce storage costs by 20–35% through systematic purging; reduce e-discovery costs by 50–70% in litigation. Why best: Retaining data beyond its purpose is a GDPR violation (Article 5(1)(e) storage limitation principle) and creates legal liability — the more data you hold, the more you can lose or be compelled to disclose.
Sources: GDPR Article 5(1)(e); CCPA §1798.100; HIPAA 45 CFR §164.530; SOX Section 802; ARMA International "Generally Accepted Recordkeeping Principles" (2017).
Inventory all data categories — identify every type of personal and business data the organization holds: employee records, customer data, financial records, contracts, logs, backups, and communications. Data you don't know about can't be managed.
Identify applicable legal retention requirements — map each data category to its legal retention obligation: HR records (varies by jurisdiction, typically 3–7 years), financial records (SOX: 7 years for auditors), health records (HIPAA: 6 years), contract records (typically statute of limitations + 1 year).
Define business purpose duration — for each data category, document the active business purpose (e.g., "customer purchase history: needed for support and returns for 2 years"). Retention ends when business purpose ends, unless law requires longer.
Set retention periods — the retention period is max(legal minimum, business purpose duration). Document the rationale. Where the law says "no longer than necessary," define "necessary" explicitly.
Design the retention schedule — create a retention schedule table: Data Category → Legal Basis → Minimum Legal Period → Business Period → Retention Period → Deletion Method → Owner. This is the policy's core document.
Classify data by sensitivity and location — apply retention rules by data classification (public, internal, confidential, restricted) and by system (CRM, HR system, email, cloud storage, backups, logs). Each system needs a deletion mechanism.
Build legal hold procedures — define the process for placing a legal hold (suspending routine deletion) when litigation or regulatory investigation is anticipated. Holds must be documented and lifted when the matter concludes.
Implement automated deletion where possible — configure systems to automatically delete or anonymize data at the end of the retention period. Manual deletion is unreliable; automation is the only scalable approach.
Define secure deletion standards — specify deletion methods by data type: electronic data (NIST SP 800-88 compliant wiping or cryptographic erasure), physical records (cross-cut shredding), cloud data (provider-verified deletion with certificate).
Train staff and audit compliance — conduct annual training for all data handlers; conduct semi-annual audits of actual retention vs. policy; report compliance metrics to leadership. Update policy when laws change or new data categories are created.