California CPRA Retention

A covered business must disclose at collection how long it intends to retain each category of personal information or, when a fixed period is not possible, the criteria it uses to determine that period. The business cannot retain a category longer than reasonably necessary for the disclosed purpose for which it was collected.

Build retention by data category and purpose. For each record set, identify the collection notice, primary and compatible purposes, minimum period needed, legal or operational dependency, deletion or deidentification event, system owner, and exception handling. An objective criterion should identify the event and rule used to calculate a deletion date. A bare statement such as "we keep data as long as necessary" does not explain the criteria or show that systems can execute them.

Section 7002 also limits collection, use, retention, and sharing to what is reasonably necessary and proportionate for a disclosed compatible purpose or a purpose covered by valid consent. A new incompatible purpose requires fresh notice and consent before processing. Separate routine retention from records preserved for a legal obligation, dispute, security investigation, or applicable deletion exception, and restrict retained exception data to that purpose.

Keep the notice-at-collection text, data inventory, category-and-purpose retention schedule, system configuration, deletion or deidentification test, vendor instruction, backup treatment, exception or hold record, consumer-request logs where relevant, owner approval, and review date. Evidence should connect the public statement to actual deletion behavior.

Common failures include using one indefinite period for all data, stating criteria that systems cannot execute, resetting a retention clock when data moves systems, retaining derived or logged copies after deleting the primary record, allowing a legal hold to cover unrelated data, or changing to an incompatible purpose without the required notice and consent.