Data Lifecycle Management
Data Lifecycle Management tests whether you can govern data from creation to destruction: what is collected, how long it is kept, who may archive it, and how disposal is evidenced. Items often present a conflict between a retention schedule, a deletion request and a legal hold, and expect you to resolve the precedence.
The phases and their controls
- Create or acquire: minimisation, purpose definition, lawful basis, classification at ingest.
- Store: encryption, location and residency, backup and replication rules.
- Use and share: access approval, masking, contractual flow-down to third parties.
- Archive: tiering to lower-cost storage, integrity checks, retrieval testing.
- Destroy: sanitisation, approval, evidence, and removal from every replica.
Retention periods are set by the longest applicable obligation - statutory minimum, contractual term, limitation period for legal claims - balanced against the storage limitation principle, which forbids keeping data longer than necessary. A legal hold suspends deletion for named data regardless of the schedule; it is not discretionary.
Disposal must be defensible: documented approval, executed method, and a certificate naming the data set, the media, the method and the date. NIST SP 800-88 describes three sanitisation categories - clear (logical techniques against a robust keyboard-attack threat), purge (resists laboratory attack), destroy (physical destruction). Crypto-shredding, destroying the keys that protect encrypted data, is a valid purge-class technique when keys are properly managed.
Worked example
A bank receives an erasure request from a former customer whose mortgage is in active litigation. Reasoning: erasure is not absolute. Defending legal claims is an exemption, and an active legal hold overrides both the retention schedule and the erasure request. Actions: verify identity; check the legal hold register; refuse erasure only for data within hold scope, giving reasons; delete everything outside that scope; document the decision and the scope boundary; respond within the statutory one-month window. Deleting held data would constitute spoliation.
Traps that cost marks
Deleting primary records but leaving backups scheduled for years. Believing that a delete action in an application removes the data from replicas, caches and search indexes. Retaining everything because storage is cheap - that breaches storage limitation and expands discovery exposure. Running disposal with no certificate or approver. Assuming an erasure request always wins against a hold.