| name | retention-exception-mgmt |
| title | Retention Exception Management |
| description | Manages retention exception workflows including request-approval processes, duration limits, periodic review cycles, documentation requirements, and audit trail maintenance. Covers legitimate grounds for extending retention beyond scheduled periods and governance controls to prevent indefinite data hoarding. Activate for retention exception, retention extension, data hoarding prevention, retention override queries. |
| author | mukul975 |
| author_url | https://github.com/mukul975/Privacy-Data-Protection-Skills/tree/main/skills/privacy/retention-exception-mgmt |
| license | Apache-2.0 |
| version | 0.1.0 |
| execution_mode | open |
| jurisdiction | general |
| practice | data-protection |
| language | en |
Retention Exception Management
Overview
Retention exceptions are formal, time-limited deviations from the approved data retention schedule. While the retention schedule defines default retention periods based on legal basis and processing purpose, legitimate business or legal circumstances may require retaining specific data beyond the scheduled period. Without a rigorous exception management process, exceptions become a mechanism for indefinite data hoarding that undermines the storage limitation principle under GDPR Article 5(1)(e). This skill defines the governance framework for requesting, approving, monitoring, and expiring retention exceptions.
Legal Context
GDPR Article 5(1)(e) — Storage Limitation
The storage limitation principle requires that personal data not be kept longer than necessary. Any extension beyond the retention schedule must be justified and documented. Exceptions must be genuinely necessary, proportionate, and time-limited.
GDPR Article 5(2) — Accountability
The controller shall be responsible for, and be able to demonstrate compliance with, the data protection principles. Retention exceptions must be documented with sufficient detail to demonstrate that each exception is justified and proportionate.
GDPR Recital 39 — Time Limits
Time limits should be established by the controller for erasure or for periodic review. Exceptions to these time limits must themselves be subject to periodic review.
Exception Categories
Legitimate Grounds for Retention Exceptions
| Category | Description | Maximum Duration | Approval Level |
|---|
| Legal hold | Litigation, regulatory investigation, or audit requiring data preservation | Duration of legal proceedings + 6 months | Legal Counsel (mandatory) |
| Regulatory requirement | New or updated regulatory requirement mandating extended retention not yet reflected in the schedule | Until schedule is updated (max 6 months) | DPO + Legal |
| Contractual obligation | Contract requires retention beyond default period | Duration of contractual obligation + limitation period | Business Owner + DPO |
| Ongoing dispute | Unresolved customer complaint or dispute not yet escalated to formal proceedings | 12 months (renewable) | DPO |
| Business continuity | Data needed for system migration, audit, or disaster recovery beyond normal period |
