FDE Foundations · Module 11: Security & Data
Data Retention and Privacy
Every stored record is a liability with a rent bill. Classify data with the customer, set retention per class, minimize what you collect, and build deletion that actually reaches everywhere.
10 min reading
Objectives
- Classify data and set retention per class with the customer
- Minimize: collect and keep only what the feature needs
- Design deletion that reaches backups and logs
Classify and agree
Four classes usually suffice: identifiers (names, emails), business data (invoices, documents), technical data (logs, traces), and secrets. For each: who may see it, where it may live, how long it stays. Agree this with the customer in the brief; retention defaults belong to them, and regulators and their lawyers have opinions.
Minimize
The cheapest data to protect is data you never took. Logs rarely need full payloads; sample or truncate. Pseudonymize identifiers in analytics. AI features especially: sending whole documents to a model when three fields answer the question is a privacy decision someone must approve explicitly.
Deletion that works
Deletion is a feature with a test: the request (from a user or the customer's DPA), the path through primary store, caches, queues, search indexes, and the statement about backups (typical honest answer: backups age out on schedule, restores re-apply deletion). Log the deletion event itself, minus the deleted content.
Cross-border and processors
Note where data physically lives and which processors touch it (hosting, email, model provider). The customer's compliance team will ask in the first month; the answer is a one-page table you already wrote.
Quick check
An optional 2-3 question self-check. Answers never leave your device, are not stored, and never count toward any assessment.
Exercise
Write the data map for a fictional support assistant: the four classes with examples from this system, retention per class, the deletion path through five stores, and the model-provider note.
Pass criteria
Classes have system-specific examples, retention is numeric per class, deletion path covers index and cache plus the backup statement, and the processor note names provider and data location.