01 Retention + deletion
A duration without a start event, system action, exception and backup rule is not an implementable retention decision.
Code-native system diagram
Category and purpose lead to an event, exception check, system action and evidence of the outcome.
02 Provision-aware reading
· in force
Selected definitions, institutional machinery and rule-making provisions are in force. That does not make every substantive operating duty discussed in this article currently operative.
Check the phased ledger· notified future commencement
Most day-to-day Data Fiduciary duties discussed here sit in the notified eighteen-month cohort. The displayed date is derived from the status ledger and must be rechecked against later instruments.
Check the phased ledgerPreparation record · not a statutory status
Build a retrievable operating record now: owner, system, evidence, test result, exception and next review. This is readiness work, not a prescribed certification pack or legal conclusion.
Check the phased ledgerExecutive summary
Retention policies often name years but omit the event that starts the clock and the system state that should follow. Engineers then cannot distinguish an active customer, abandoned lead, disputed transaction, legal hold or stale export. Event-based design translates purpose and legal review into testable lifecycle rules.
The final Rules contain specific retention provisions in a notified future cohort, including class-specific deemed-purpose periods and a separate one-year rule for specified purposes and records. They must be read carefully with the Act and other applicable law. This article proposes a design method; it does not prescribe a universal duration.
Operating note · 01
Choose a real journey such as an unqualified lead, completed order or closed support case. List the records it creates, why each exists and which state changes matter. A lead can become active, disqualified, converted, disputed or manually exported. Each state may need a different end-of-purpose assessment and owner.
Do not collapse production records, analytics copies, logs, backups and exports into one row. They have different actions and technical constraints. Keep the model small enough to operate, then extend it when evidence shows another copy.
Operating note · 02
“Keep for three years” is incomplete. Three years from account closure, last interaction, contract end or transaction date will produce different results. Define the event, system field, time zone, source of truth and behaviour when the event is missing. State which new activity resets the clock and whether a rights request changes it.
The final Rules include specific future-cohort deemed-purpose provisions for named classes and purposes. Do not generalise those schedules to every organisation. Map applicability with qualified review and keep other legal retention rules visible as separate exceptions.
Operating note · 03
Legal retention, disputes, fraud investigation, security preservation and documented holds can affect the normal action. Each exception needs authority, scope, approver, review date and release event. “Hold forever” is not a controlled exception. Restrict access and purpose while the exception applies.
Avoid letting one record under hold freeze an entire account or dataset without analysis. Engineers need a way to separate linked records where appropriate. Privacy and legal reviewers need a report of open exceptions and overdue reviews without exposing the full underlying content.
Operating note · 04
Deletion can mean hard delete, anonymisation, token separation, restricted archive or queued expiry depending on the record and justified need. Name the action, system API or job, failure route and downstream dependency. Correct references and indexes so a deleted record is not rediscovered through search or re-created by a synchronisation job.
Exports, caches, data warehouses and personal spreadsheets require owners. A primary database job does not reach them automatically. Use an export register and expiry controls. For backups, describe isolation, expiry and what happens if a restore reintroduces data that passed its lifecycle event.
Operating note · 05
Where a future-cohort provision calls for advance information before certain erasure, the workflow must identify the relevant class and event, select a registered communication channel and preserve delivery evidence. Do not turn that rule into a universal marketing re-engagement campaign. Keep the message limited to the lifecycle purpose.
Automated deletion needs guardrails: dry-run counts, sampled identifiers, dependency checks, rate limits, failure alerts, rollback decisions and access separation. Rollback does not necessarily mean restoring all deleted personal data; it means recovering the service safely while preserving authorised lifecycle decisions.
Operating note · 06
Create a synthetic record that travels through the normal systems, then trigger the retention event. Record job time, affected locations, failures, exception behaviour and residual search results. Repeat after schema, integration or backup changes. Never use a real person’s data merely to make the test realistic.
Report coverage honestly: systems tested, copies not reached, exceptions open and next action. A passing job does not prove a legally correct duration, and a legally reviewed schedule does not prove the job worked. Readiness requires both decisions and execution evidence.
Five-role checklist
A role label is a starting point. Assign named internal owners, evidence locations and review dates in an approved system; this site stores none of them.
Conclusion
Start with one record type and write an event, exception, action and evidence rule that engineering can test. Then follow the copies. The goal is not the shortest policy; it is a controlled lifecycle that can explain both deletion and justified retention.
Validate durations and applicability against current law and facts. This article is an implementation method, not a universal schedule.
Pinpoint official record
Gazette instruments govern the text and commencement. Government explainers are contextual; this field note remains editorial analysis.
Section 8(7) and related provisions: erasure when purpose is no longer served, subject to legal retention
↗Rule 8 and Third/Seventh Schedules: future-cohort deemed-purpose, notice and minimum retention provisions
↗Rule 6: logs, monitoring, continuity and backups
↗Paragraph (c): substantive retention provisions in the eighteen-month cohort
↗Published corrections read with the final Rules
↗Initial private-preview article created against the final Rules, commencement notification and published corrigendum.
Human-review gate: pinpoints, status and fact-specific interpretations must be rechecked before public reliance.
12 Continue with evidence
Use a template, inspect the mapped controls or answer the readiness assessment with only what your team can retrieve.