Compliance
Records retention that survives an audit
Keeping everything forever is not caution, it is a liability. What retention actually has to prove, and why deletion is the hard part.
Two obligations pulling opposite ways
Regulators and courts require you to keep certain records for defined periods. Data protection law requires you not to keep personal data longer than necessary. Those pull in opposite directions, and a policy of keeping everything forever fails the second one.
Retention is therefore not a storage decision. It is a decision about categories: what must be kept, for how long, and what must then be provably destroyed.
What an auditor actually asks for
A schedule that names categories and periods
Not a policy saying seven years for everything. A schedule mapping record types to periods and to the obligation that sets each one.
Evidence the policy is applied, not just published
Which policy covers which locations, when it was applied, and what it did. A published policy nobody deployed is worse than none, because it demonstrates awareness without action.
Evidence that deletion happened
The hardest one, and the one most organisations cannot produce. Disposition review in Purview generates this record. Ad hoc deletion does not.
A defensible answer for legal hold
How holds are applied, who can apply them, and how they interact with retention. A hold that silently overrides a deletion obligation needs to be a decision, not an accident.
Why deletion is where this fails
Retention is easy to configure and psychologically comfortable. Deletion is neither. Nobody wants to be the person who approved destroying something, so disposition reviews go unactioned and content sits in retention indefinitely.
Name an owner per category with authority to approve disposition. Without that, the schedule is aspirational and the audit finding writes itself.
The verdict
A category schedule with named owners and disposition review turned on
It produces the three things an auditor asks for: the schedule, evidence of application, and evidence of destruction.
Do not apply a single long retention period across the whole tenant. It satisfies the record-keeping obligation and breaches the storage limitation one, and it makes every future subject access request more expensive.
Disclosure. Some links on this site are affiliate links. Scoring weights are published before any programme is joined, and commission is never a ranking input. Full policy, and the method behind this guide.