Retention Conflict at Northwind Mutual
Northwind Mutual, a regional insurer, runs a cloud data platform holding 1,400 datasets. The central data governance policy says customer records must be retained for seven years and then purged. Last quarter the marketing team created its own storage bucket for behavioral event data and configured deletion after 13 months to cut storage cost. The marketing director argues that shorter retention reduces risk and cost, while the records manager says the central schedule is mandatory. The data catalog shows only 600 datasets have a named owner; the rest are tagged 'unknown.' Claims litigation has placed legal holds on three datasets, but the hold list is maintained in a spreadsheet. A privacy officer now asks which retention rule governs, and the audit committee wants assurance before the next regulatory examination. No one can say whether the marketing events contain customer identifiers.
1. Which retention rule should govern the marketing event data, and what facts must be established before any deletion? Explain the precedence among legal hold, regulatory retention, and business cost preferences.
Read the worked answer
The first step is not to choose between 13 months and seven years; it is to determine what the data actually is. Establish whether the behavioral events contain customer identifiers or can be linked to an individual, which jurisdictions and recordkeeping rules apply, and whether any litigation hold covers the bucket. Legal hold takes precedence over every retention schedule: if the events are relevant to the claims, deletion must stop until counsel releases the hold. A regulatory retention period is usually a floor, not a target; business cost cannot override it. If the events are customer records under the central schedule, the marketing rule is an unauthorized exception and deletion should be frozen. If they are genuinely de-identified operational events, a shorter period may be defensible, but only after privacy and legal approve a documented exception. The records manager owns the schedule; the marketing director owns the business need, not the legal obligation. Before deletion, require a data-type assessment, jurisdiction check, legal-hold clearance, and catalog metadata showing the retention basis. The audit committee should see that no deletion proceeds on an undocumented assumption.
2. Design the decision rights and exception workflow the insurer needs, including who can approve a shorter retention period and how the 800 unowned datasets should be handled.
Read the worked answer
Decision rights should be explicit. A data governance council, chaired by the Chief Data Officer with privacy, legal, records management, and security representation, owns the retention standard. Business data owners are accountable for applying it to their datasets. Privacy and legal must approve any shorter retention or deletion exception; cost savings alone is not an approval criterion. The workflow should require a request naming the dataset, data types, jurisdictions, proposed period, and business justification, followed by privacy and legal impact review, a time-bound approval, and an audit-log entry. Approvals should expire and be re-reviewed. For the 800 unowned datasets, do not simply assign names in the catalog. Group them by source system and business process, assign interim owners at the domain level, and freeze deletion until ownership is confirmed. Set a 60-day deadline for attestation, escalate unclaimed datasets to the governance council, and require that any dataset without a confirmed owner be treated as containing personal data for protection purposes. This converts an inventory gap into a controlled backlog rather than an invisible risk.