Data Retention Schedule Review

Data Retention Schedule Review

Purpose

Organize a review of a draft or existing data retention schedule into an attorney-ready working file. The skill inventories the data categories the schedule covers, maps each to its stated business, legal, or regulatory purpose, collects the retention-period facts as written, and surfaces where the schedule's mechanics — legal-hold overrides, deletion and anonymization steps, vendor and backup coverage — create gaps or contradictions. It produces draft legal work product for attorney review — not legal advice.

This skill never determines whether a stated retention period is legally sufficient, excessive, or compliant with any law. Retention-period adequacy varies by jurisdiction, sector, and data category, and is always an attorney-verification item. The skill also never resolves a legal-hold conflict; it identifies where the schedule and a hold obligation may collide and routes that collision to litigation or legal-hold counsel.

Use When

• The organization has a draft retention schedule and wants it checked for internal consistency and completeness before adoption.
• An existing retention schedule needs a periodic review against the current data inventory.
• A privacy, records-management, or legal-ops team wants retention periods, legal bases, and deletion mechanics organized for attorney sign-off.
• A DSAR, audit, or regulatory inquiry has surfaced a question about how long a data category is actually kept versus what the schedule says.
• Counsel needs to understand how a proposed litigation hold or preservation notice would interact with the standing retention schedule.

Required Inputs

• The retention schedule itself — the draft or existing document, spreadsheet, or policy text, provided in full. Do not review from a description alone.
• The data inventory or record of processing activities, if one exists, so categories in the schedule can be checked against what the organization actually processes. If none is available, note the gap — this review cannot independently verify that the schedule is complete against actual data holdings.
• The stated purpose for each retention period — business need, legal/regulatory requirement, or contractual obligation, as the organization or the schedule states it. Do not supply a purpose the skill infers from category name alone.
• Optional: known legal holds or preservation obligations currently in effect, so hold-override interactions can be flagged.
• Optional: vendor and backup system inventory — third-party processors, backup and archive systems, and disaster-recovery copies that may hold the same data categories outside the primary system.
• Optional: the practice group's practice-profiles/privacy.md if populated and loaded alongside this skill. If present, use its Standard Positions and Escalation Thresholds to benchmark the review; if absent, proceed without profile benchmarking.