Data retention periods documented in policy and enforced by automated jobs

GDPR Art. 5(1)(e) (storage limitation) and CCPA §1798.100(a) require that data is not retained longer than necessary for its stated purpose. A privacy policy that documents retention periods but has no automated enforcement is a compliance promise the system cannot keep — activity logs, failed login records, and temporary uploads accumulate indefinitely. ISO 27001:2022 A.8.10 and NIST SP 800-53r5 SI-12 both require defined and enforced retention schedules. Regulators treat undeclared or unenforced retention as evidence of systemic disregard for data minimization.

Document retention periods in your privacy policy and create automated jobs that enforce them. Both must exist — documentation without enforcement fails GDPR Art. 5(1)(e). Add a retention cron job in src/jobs/enforceRetention.ts:

export async function enforceRetention() {
  const now = new Date();

  // Activity logs: 90-day retention
  const logCutoff = new Date(now);
  logCutoff.setDate(logCutoff.getDate() - 90);
  await db.activityLog.deleteMany({ where: { createdAt: { lt: logCutoff } } });

  // Failed login attempts: 30-day retention
  const loginCutoff = new Date(now);
  loginCutoff.setDate(loginCutoff.getDate() - 30);
  await db.failedLogin.deleteMany({ where: { attemptedAt: { lt: loginCutoff } } });

  // Unconfirmed temp uploads: 24-hour retention
  const uploadCutoff = new Date(now);
  uploadCutoff.setHours(uploadCutoff.getHours() - 24);
  const tempFiles = await db.tempFile.findMany({ where: { confirmed: false, createdAt: { lt: uploadCutoff } } });
  for (const f of tempFiles) {
    await deleteFromStorage(f.path);
    await db.tempFile.delete({ where: { id: f.id } });
  }
}

Schedule this via Vercel Cron or a task queue; log each run so you can demonstrate enforcement to auditors.