Artifact GuideUSRetention

US CPRA Retention

Retention under the US CPRA is about setting a real retention period, saying it in the notice, and keeping personal information only as long as the disclosed purpose needs it.

This page shows what to disclose, how to pick a reasonable period or criteria, and what evidence teams should keep. Confirm legal and policy assumptions before implementation.

Back to main artifact Review sources

Author

Sorena AI

Published

May 9, 2026

Updated

May 9, 2026

Sections

Structured answer sets in this page tree.

Primary sources

Cited legal and guidance references.

Publication metadata

Sorena AI

Published May 9, 2026

Updated May 9, 2026

Overview

Retention under the US CPRA means telling consumers how long each category of personal information will be kept, or the criteria used to decide that period, and then keeping the data only for as long as is reasonably necessary and proportionate for the disclosed purpose. This page explains the core rule, the disclosure needed in the privacy notice, and the practical checks teams should use when they set or review retention periods.

Section 1

What does CPRA retention require?

The CPRA does not set one fixed number of days or months for every business. Instead, a business must disclose the length of time it intends to retain each category of personal information, including sensitive personal information, or, if that is not possible, the criteria it uses to decide that period.

The same section also says a business must not retain personal information or sensitive personal information for each disclosed purpose longer than is reasonably necessary for that purpose, and the CPPA FAQ says collection, use, and retention must be reasonably necessary and proportionate to the disclosed or expected purposes.

List each personal information category and the retention period for that category.
If a exact period is not practical, state the criteria used to choose the period.
Keep the period tied to a disclosed purpose, such as account servicing, fraud prevention, tax, or legal defense.
Delete or deidentify the data when the disclosed purpose no longer needs it.

Sources for this answer

California Civil Code section 1798.100

Requires disclosure of retention length or criteria and limits retention to what is reasonably necessary for the disclosed purpose.

California Privacy Protection Agency FAQ

Explains that retention must be reasonably necessary and proportionate to disclosed or expected purposes.

Recommended next step

Turn US CPRA Retention into assigned work

This US CPRA guide turns turn Retention into owners, evidence requests, review checkpoints, and reusable operating records inside Sorena.

Assessment workflow

Open Assessment Autopilot for US CPRA

Turn Retention into scoped questions, evidence fields, and review tasks.

Explore next step

Research workflow

Review US CPRA source evidence

Use Research Copilot to answer follow-up questions with cited source material.

Explore next step

Talk to Sorena

Talk through implementation

Review scope, evidence, owners, and the next compliance actions with Sorena.

Explore next step

Section 2

How should a business pick a reasonable retention period?

Start with the purpose for collecting the data, then ask how long the data is actually needed to complete that purpose and any closely related legal or operational obligations. Do not keep the data just because storage is cheap or because the system has no deletion rule yet.

A reasonable retention period should reflect the shortest period that still supports the disclosed purpose, any required backup or dispute window, and any legal hold or legal obligation that applies.

Tie the period to a specific purpose instead of a general business preference.
Review whether a shorter operational period would still work.
Separate ordinary retention from any legal-hold exception.
Document why the chosen period is proportionate to the purpose.

Sources for this answer

California Civil Code section 1798.100

Limits retention to what is reasonably necessary for the disclosed purpose.

California Privacy Protection Agency FAQ

Confirms the CPRA's reasonably necessary and proportionate standard.

Section 3

Who should own the retention decision and what evidence should support it?

The owner should be the team that can change the privacy notice, the data map, deletion rules, and the retention schedule, usually privacy, legal, data governance, or product operations. The reviewer should confirm the period matches the disclosed purpose and the actual business process.

Keep evidence that shows the retention period, the reason for the period, the privacy notice wording, and any later review or deletion workflow update.

Keep the approved retention schedule with the privacy notice language.
Save the business rationale for each retained category.
Record when the schedule was last reviewed and who approved it.
Keep deletion or deidentification steps documented so the schedule can be audited.

Sources for this answer

California Civil Code section 1798.100

Requires notice of retention length or criteria and supports documented retention decisions.

California Privacy Protection Agency FAQ

Explains the CPRA's notice and retention expectations for businesses.

Section 4

What should teams check before they publish or update a retention notice?

Check that the notice names each category of personal information and either gives the retention period or explains the criteria used to set it. If the business uses different periods for different systems, the notice should not hide that fact behind one generic statement.

Also check whether any data category is kept for a separate legal reason, such as a legal hold or a required recordkeeping rule, so the notice and the internal deletion workflow stay aligned.