Cloud Security Stack
Compliance and governance

Compliance

Records retention that survives an audit

Keeping everything forever is not caution, it is a liability. What retention actually has to prove, and why deletion is the hard part.

11 min read · Reviewed 22 August 2026 · Written against Microsoft Purview retention capabilities. Not legal advice.

Two obligations pulling opposite ways

Regulators and courts require you to keep certain records for defined periods. Data protection law requires you not to keep personal data longer than necessary. Those pull in opposite directions, and a policy of keeping everything forever fails the second one.

Retention is therefore not a storage decision. It is a decision about categories: what must be kept, for how long, and what must then be provably destroyed.

What an auditor actually asks for

01

A schedule that names categories and periods

Not a policy saying seven years for everything. A schedule mapping record types to periods and to the obligation that sets each one.

02

Evidence the policy is applied, not just published

Which policy covers which locations, when it was applied, and what it did. A published policy nobody deployed is worse than none, because it demonstrates awareness without action.

03

Evidence that deletion happened

The hardest one, and the one most organisations cannot produce. Disposition review in Purview generates this record. Ad hoc deletion does not.

04

A defensible answer for legal hold

How holds are applied, who can apply them, and how they interact with retention. A hold that silently overrides a deletion obligation needs to be a decision, not an accident.

Why deletion is where this fails

Retention is easy to configure and psychologically comfortable. Deletion is neither. Nobody wants to be the person who approved destroying something, so disposition reviews go unactioned and content sits in retention indefinitely.

Name an owner per category with authority to approve disposition. Without that, the schedule is aspirational and the audit finding writes itself.

The verdict

Our pick

A category schedule with named owners and disposition review turned on

It produces the three things an auditor asks for: the schedule, evidence of application, and evidence of destruction.

Who should skip

Do not apply a single long retention period across the whole tenant. It satisfies the record-keeping obligation and breaches the storage limitation one, and it makes every future subject access request more expensive.

Disclosure. Some links on this site are affiliate links. Scoring weights are published before any programme is joined, and commission is never a ranking input. Full policy, and the method behind this guide.