Audit logs retained per regulatory requirement

GDPR Article 30(1) requires records of processing activities to be maintained — without a defined retention window, these records will either grow unbounded (prompting an engineer to delete them without proper review) or get purged on an arbitrary schedule shorter than regulatory requirements. GDPR Article 5(2) accountability and CCPA §1798.185(a)(8) both require that records demonstrating compliance be available for regulatory inspection. Common guidance across CAN-SPAM, GDPR, and state privacy laws converges on 3-5 years for consent and processing records. A 90-day purge window — common in log management systems — falls catastrophically short of this.

Define retention constants explicitly in code and use them in all purge jobs — never hardcode day counts at the call site:

// src/lib/compliance/constants.ts
export const AUDIT_LOG_RETENTION_DAYS = 1825    // 5 years (conservative)
export const CONSENT_RECORD_RETENTION_DAYS = 1825

// src/lib/compliance/purge.ts — runs as a monthly cron job
import { AUDIT_LOG_RETENTION_DAYS } from './constants'

export async function purgeExpiredAuditLogs() {
  const cutoff = new Date()
  cutoff.setDate(cutoff.getDate() - AUDIT_LOG_RETENTION_DAYS)

  const { count } = await db.auditLog.deleteMany({
    where: { createdAt: { lt: cutoff } }
  })

  await logger.info('audit-log-purge', { deletedCount: count, cutoff })
}

Add a code comment on AUDIT_LOG_RETENTION_DAYS explaining the regulatory basis so future engineers understand why this constant cannot be reduced without a legal review.