Record retention
How long consent records and other data are kept, when a record can be deleted, and what stays behind after deletion.
Retention decides how long a consent record is kept after its consent has ended. You choose the period. Deletion happens only where the deployment has turned it on.
The retention period#
Keep evidence for, in Project settings, sets the period: 1 year, 3 years, 7 years or 10 years. The default is 7 years. Choices shorter than the period rule 8(3) of the DPDP Rules sets, now one year, are not offered, and the API refuses one with 400 RETENTION_BELOW_LAW. The period in force is on Law updates.
When a record is deleted#
A daily job deletes a record only when all of these hold:
- The deployment runs with retention enforcement on. It is off by default. Where it is off, nothing is deleted.
- The consent has ended. The record is Expired, Withdrawn or Denied.
- The record's expiry date is further back than your period.
- A calendar year has passed since the record was last processed and since its last event.
The period is counted from the expiry date, also for a withdrawn or refused consent. An export or an erasure made after the consent ended counts as an event.
Two kinds of record are never deleted for age. One is a record whose consent is still in force. The other is a record with no expiry date.
Each deletion is written to the audit log, with the number of records deleted.
An example#
Your project keeps evidence for 7 years. Meera Iyer's consent expires on 1 March 2027 and she never answers again.
The record stays as Expired. In early 2034, about seven years later, the job deletes it. If the deployment does not enforce retention, the record stays.
What deletion leaves behind#
A deleted record and its events are gone. The product keeps one hash for each sealed event of the record.
That hash keeps the daily anchor of that day valid. Receipts issued earlier also still verify.
How long other data is kept#
| Data | How long |
|---|---|
| Test records, written with test keys | 30 days after their last change |
| Webhook delivery logs, and failed events kept for replay | 30 days |
| Processor tasks and their reports | As long as their record |
| Hashes of erased people's identifiers | For the life of the project, so an import or a notice campaign does not add them back. Those of test records go 30 days after the erasure |
| Notice campaigns, their people and answers | Not deleted by the product. Erasing a person removes their identifiers from every campaign |
| Encrypted copies of notice links | 7 days after the batch is issued |
| Identifying details on an erased record | Removed at once. For a record under India's DPDP Act, kept until a year after its last processing. |
| Rights requests | Not deleted by the product |
| Audit log | Not deleted by the product. The database refuses deletions; see Remove old entries |
| Breach register | Not deleted by the product |
| Daily anchors | Not deleted by the product |
Limits#
- You cannot turn deletion on from the console. Ask the people who run your deployment whether retention enforcement is on.
- Deletion cannot be undone.
- The job runs once a day and deletes up to 500 records for each project.
- Retention acts on whole records. To remove one person's identifiers, erase the person.