We use analytics cookies.We use cookies to analyze site traffic and improve your experience.
Loading...
System Design Masterclass · Data Governance Compliance
Free preview: the first 2 parts of this 7-part lesson.
Already bought the course? Sign in to read the whole lesson.
this lesson is part of
System Design Masterclass
Unlock this lesson and the 751 other paid lessons
$25 once, by PayPal
See the System Design courseread the rest of this lesson in
System Design Masterclass
Unlock this lesson and the 751 other paid lessons
$25 once, by PayPal
See the System Design coursein Data Governance Compliance
This lesson is part of the full System Design Masterclass. Unlock it along with 769 other lessons for a one-time payment.
One-time payment by card or PayPal
Get Lifetime AccessOne-time payment: UPI, card or netbanking
Get Lifetime Access18 Foundation lessons are free, no payment needed. Try them now
It is easy and good
“It is really nice and good Please join the course”
A startup stores every piece of data it has ever collected. User profiles, session logs, analytics events, error logs, temporary files, abandoned cart data, all of it, forever. Five years later, their storage bill is $15,000/month and growing. Their database is slow because it's querying across millions of irrelevant records. A GDPR deletion request takes two weeks to process because data is scattered across 40 tables and 3 backup systems.
Storing data without a retention policy is like never cleaning your house. Eventually, you can't find anything, everything is slow, and the costs are enormous.
A data retention policy defines how long each type of data is kept, when it's archived (moved to cheaper storage), and when it's permanently deleted. It answers: "After this data has served its purpose, what happens to it?"
| Component | What It Defines | Example |
|---|---|---|
| Data category | What type of data | User profiles, transaction logs, analytics events |
| Active retention | How long data stays in the primary database | Transaction data: 2 years in primary DB |
| Archive period | How long data is kept in cold storage | Transaction data: 5 more years in S3 Glacier |
| Deletion | When data is permanently destroyed | Transaction data: deleted after 7 years total |
| Legal hold | Override that prevents deletion | "Don't delete anything related to case #4521" |
| Trigger | What starts the retention clock | Account deletion, contract end, last activity |
Regulatory requirements drive retention:
| Regulation | Requirement |
|---|---|
| GDPR | Delete personal data when no longer needed for its purpose. Users can request deletion at any time. |
| SOX | Financial records: 7 years minimum. Auditors will ask for 5-year-old transactions. |
| HIPAA | Medical records: 6 years from last use. Some states extend to 10+ years. |
| PCI DSS | Cardholder data: delete when no longer needed. Audit logs: 1 year minimum, 3 months immediately available. |
| Tax law | Financial records: 3-7 years depending on jurisdiction. The IRS can audit 6 years back for substantial understatement. |
The challenge: GDPR says "delete when no longer needed" while SOX says "keep for 7 years." When both apply to the same data, you keep for 7 years because the legal obligation to retain overrides the general deletion requirement. GDPR Article 17(3)(b) explicitly exempts data needed for legal compliance.