The Retention Schedule Nobody Owns
You are the newly hired privacy officer at a 600-employee regional insurer. During onboarding you discover the following: the records retention schedule was last revised in 2019, lists 41 record categories, and names an 'owner' for only 12 of them. The marketing team keeps lead-capture spreadsheets in a shared drive with no deletion rule; some rows date to 2016. HR stores terminated-employee files indefinitely because 'legal might ask.' The privacy office has one analyst and no budget line of its own. The CISO reports to the CIO, and the privacy officer reports to the general counsel. The board's audit committee meets quarterly and has asked twice in 18 months for a privacy program status update; both times it received a two-slide summary prepared by the analyst. Executive leadership has not formally approved a privacy program charter.
1. Given these facts, what should you do first, and why is that the right first move rather than drafting a new retention schedule?
Read the worked answer
The first move is to establish formal program authority and governance, not to fix the schedule.
Reasoning:
- No approved charter means the privacy office's mandate, scope, and decision rights are undefined. Any retention work you do can be overridden or ignored by business units that never agreed to it.
- The reporting structure (privacy to GC, security to CIO) and the absence of a budget line mean the program has no independent resourcing path. A schedule with no enforcement mechanism is a document, not a control.
- The board has already asked twice. That is latent demand for assurance you can convert into a mandate.
Concrete first steps:
- Draft a one-page program charter defining scope, roles, the privacy officer's authority to require records of processing, and escalation paths.
- Get it approved by the executive committee and noted by the audit committee at its next meeting.
- Use the board request as the forcing function: propose a quarterly privacy reporting cadence with defined metrics.
Drafting the schedule first would produce a 41-category artifact with 29 unowned categories and no authority to enforce it - the same failure mode as the 2019 version.
2. The marketing lead-capture data and the HR terminated-employee files are both over-retained. How do you prioritize between them, and what does each remediation require?
Read the worked answer
Prioritize by risk exposure, not by volume or by which team is easier to deal with.
Marketing lead data - higher priority:
- Contains prospect personal data collected without a stated retention period; some records are ~9 years old.
- Likely collected under a consent or notice that did not disclose indefinite retention - a notice-accuracy problem, not just a hygiene problem.
- Spread in an ungoverned shared drive: no access control evidence, no deletion logging.
- Remediation: inventory the spreadsheets, define a retention period tied to the purpose (e.g., last contact + a defined window), purge beyond that, and put a deletion rule in the system of record rather than relying on manual cleanup.
HR terminated-employee files - lower urgency but still required:
- Retained under a defensible 'legal might ask' rationale, but indefinite retention exceeds what most limitation periods justify.
- Remediation: define retention by record type (payroll, benefits, disciplinary, general personnel), align to employment-law limitation periods, and document the legal basis for each period.
Why this order: the marketing data has an active notice-accuracy and access-control exposure; the HR data is an over-retention exposure with a plausible (if overbroad) justification. Both need owners named in the schedule - that is the structural fix.
3. The audit committee asks: 'How do we know the program is working?' What do you propose, and what would you explicitly not promise?
Read the worked answer
Propose a small set of measurable indicators the program can actually produce with one analyst.
Propose:
- Retention compliance rate by record category (% of categories with a named owner and an enforced deletion rule) - directly addresses the 12-of-41 gap.
- Records-of-processing coverage: % of business units with a completed and current inventory.
- Training completion and phishing/privacy incident rate per 1,000 employees.
- Time-to-contain for privacy incidents (median days from detection to containment).
- Open remediation items by age, reported to the committee each quarter.
Do not promise:
- A single 'risk score' or maturity rating that implies precision the data cannot support.
- Full compliance attestation. With one analyst and no budget line, you can attest to coverage of defined activities, not to the absence of issues.
- That the board's two-slide summary problem is solved by more slides - the fix is a standing cadence with stable metrics, so trend matters more than any single quarter.
Framing: present the 29 unowned categories as the baseline, commit to a target (e.g., all 41 owned within two quarters), and report against it. That converts an uncomfortable finding into a trackable commitment the committee can hold you to.