A data retention policy states how long different kinds of data are kept, why, and how they are securely deleted or de-identified at the end. It covers things like CCTV footage, customer records, loyalty data, sales records and analytics data.
The policy lists each data type, the reason for holding it, the retention period, who is responsible and the disposal method. Some periods are set by law, for example tax and employment records must usually be kept for several years, while others are a business decision.
Under Australian Privacy Principle 11, organisations covered by the Privacy Act must take reasonable steps to destroy or de-identify personal information they no longer need. In retail and hospitality, this commonly affects video footage, Wi-Fi sign-up data, booking details and old customer lists.
Common problems are keeping everything indefinitely, backups that are never purged and having no one accountable for deletion. Aggregated visitor counts are generally low risk and can be kept long term for trend analysis, whereas footage or identifiable data should be kept only as long as needed. Document the policy and test that deletion works. Review it at least annually, and whenever you add a new system that collects data.
Holding less personal data reduces the damage if a breach occurs, so retention is as much a security measure as a compliance one.