Regulation & Policy
Data retention
Also known as: data retention policy, retention period
Data retention is the policy and practice of deciding how long records and personal data are kept before they are deleted or anonymised. Under UK GDPR, personal data must not be held for longer than necessary for the purpose it was collected for, and organisations are expected to document their retention periods. In marketing it governs how long CRM records, analytics data, form submissions and AI tool logs can be retained.
What it is
A retention policy sets a defined period, or the criteria for determining one, for each category of data an organisation holds. It usually combines legal requirements, such as statutory record-keeping for tax or employment, with business need and the purpose stated in a privacy notice. Retention is paired with a deletion or anonymisation process so data does not simply accumulate by default.
Why it matters
Retention limits reduce the size of a breach, cut storage and licence costs, and keep an organisation defensible if a regulator or customer asks how long data is held. For marketing teams, holding contact records or behavioural data past a justified period undermines consent and creates risk in email, advertising and CRM programmes. Retention settings also directly shape what historical data is available for reporting and attribution, so decisions need input from analytics as well as legal.
How it works
Teams build a data inventory, group data into categories, assign a retention period and lawful basis to each, then automate deletion or anonymisation where possible. Tool-level settings matter too, such as analytics retention windows, CRM inactivity rules, chat and support transcript policies, and whether AI vendors retain prompts and outputs for training. Reviews are typically scheduled annually or when a new system, processor or data type is introduced.
When it applies
It applies to any organisation holding personal or regulated data, and becomes pressing during privacy audits, vendor onboarding, breach response, subject access or erasure requests, and platform migrations.
Examples
- A B2B company sets a rule to delete marketing contacts with no engagement for 24 months unless there is an active contract.
- A retailer extends its web analytics retention window before an annual reporting cycle, having documented the business justification.
- An agency reviews an AI writing tool's terms and switches to an enterprise plan where prompts are not retained for model training.
How it is measured
- Percentage of data categories in the inventory with a documented retention period and owner
- Volume of records held beyond their stated retention period
- Time to complete erasure and subject access requests against the regulatory deadline
- Proportion of systems and processors with automated deletion configured rather than manual purges
Insights on Data retention
Related terms in Regulation & Policy
- AI complianceAI compliance is the work of making sure AI systems meet the laws, regulations, standards and internal policies that apply to them. It spans data protection, transparency, risk classification, documentation, human oversight and record keeping across the life of a system. In practice it combines legal interpretation, engineering controls and ongoing evidence gathering.
- AI governanceAI governance is the set of policies, roles, controls and review processes an organisation uses to manage how AI systems are built, bought and used. It covers risk assessment, documentation, human oversight, data handling and accountability. It applies both to AI a company develops and to third-party AI tools used by staff.
- AI privacyAI privacy is the set of practices, rights and obligations that govern how personal data is collected, used, stored and exposed when building or using AI systems. It covers training data, prompts and outputs, retention by AI vendors, and the transparency and control offered to the people whose data is involved. For marketing teams it shapes what customer data can safely be put into AI tools and what must be disclosed.
- AI safetyAI safety is the practice of designing, testing and operating AI systems so they cause less harm, behave predictably and resist misuse. It covers alignment with intended behaviour, evaluation and red teaming, content guardrails, and monitoring once a system is live. For marketers it shapes what models will say, how assistants handle brands, and what compliance teams expect before AI tools go into production.
- AI transparencyAI transparency is the practice of making clear how an AI system works, what sits behind it, and when content or an interaction involves AI. It covers regulatory disclosure duties as well as voluntary explanations such as model cards, labels on synthetic media and citations in AI generated answers. For publishers and marketers it sets expectations about when AI involvement should be declared and how clearly.
- Competition and Markets AuthorityThe Competition and Markets Authority (CMA) is the United Kingdom's competition and consumer protection regulator. It investigates mergers, anti-competitive conduct and market practices, and it holds specific powers over large digital firms under the Digital Markets, Competition and Consumers Act 2024. Its decisions shape how search engines, app stores and AI assistants operate in the UK market.
Primary research · August 2026
How ChatGPT Shortlists Software Brands
An audit across 10 categories and 60 buying questions. I recorded what ChatGPT reads, throws away and links to when a buyer asks it which software to buy, and what that decides.
- 60
- Questions asked
- 10
- Software markets
- 2,680
- Results read
- 367
- Links shown
Free download
Get the full report
35 pages · PDF · 536 KB. Enter your details and it downloads straight away.