Managing data retention

Data retention is where you record what your account keeps after somebody is erased, and why. It is the screen an auditor asks for, and most of it is evidence rather than configuration.

For what anonymising and purging actually remove, read How purging, anonymising and legal holds work.

Where it is

Choose Admin, then Workspace and Data retention.

Certificates: choose a legal basis

The first section decides whether certificates survive erasure, and on what legal basis.

A new account starts with certificates retained and the basis not yet confirmed — and because it is unconfirmed, the screen carries a review due date rather than leaving it indefinitely.

Confirming a real basis clears that review date. An unconfirmed position is treated as temporary by design: you are keeping records without having said why, and the date is the product declining to let that become permanent quietly.

So this is the one thing on the screen to do rather than read. Choose the basis your organisation actually relies on and save.

Legal holds

A hold stops anonymise and purge for everybody it covers, for as long as it is active.

Place legal hold creates one. The list shows what is active, and an empty list means nothing is currently protected from erasure.

Two behaviours are worth knowing before you place one, and both are covered in the deep dive: a hold cancels a queued purge rather than pausing it, and a hold on a department pins the people in it at the moment you place it.

The retained-set log

Everything kept after an anonymise or a purge is written here, with what it was and why it was retained. Export CSV takes the lot.

This is the section that answers “you said you erased them — what is this?”. Nothing is added by hand; entries appear as erasures happen.

Subject data exports

Article 15 requests — somebody asking for a copy of everything you hold about them — appear here once started.

They are not started from this screen. An export begins from the person’s own actions menu in People, and this list is where you watch it finish. Refresh updates it; there is no notification on the screen itself.

That split catches people out. If you are here looking for a way to begin one, you are on the wrong screen.

What happens when you save

Saving the certificate policy records your basis and, where the basis is confirmed, removes the review date. It does not retrospectively change anything already retained — the retained-set log is a record of decisions already taken, and a new policy applies from now on.