Written retention schedule for each data type; automated deletion confirmed

GDPR Art. 5(1)(e) requires data to be kept in identifiable form no longer than necessary — "storage limitation" is a core data protection principle, not an optional enhancement. Art. 13(2)(a) requires retention periods to be disclosed in the privacy policy, creating a legal promise you must technically enforce. CCPA §1798.105 gives California residents the right to demand deletion, which requires that you have the infrastructure to actually delete. ISO-27001:2022 A.8.10 requires media disposal and data deletion controls. An undocumented or unenforced retention schedule is also a significant incident amplifier: data you promised to delete but didn't can appear in a breach years after the user expected it was gone.

Document retention periods in your privacy policy and enforce them with an automated cron job. Align the cron schedule with what the policy promises.

// app/api/cron/cleanup/route.ts
// Schedule via vercel.json: { "crons": [{ "path": "/api/cron/cleanup", "schedule": "0 2 * * *" }] }
export async function GET() {
  const logCutoff = new Date()
  logCutoff.setDate(logCutoff.getDate() - 90)

  await db.auditLog.deleteMany({ where: { createdAt: { lt: logCutoff } } })

  const graceCutoff = new Date()
  graceCutoff.setDate(graceCutoff.getDate() - 30)

  await db.user.deleteMany({ where: { deletedAt: { lt: graceCutoff } } })

  return Response.json({ ok: true })
}

For each data type in your policy, implement the matching cleanup: analytics events at 26 months, server logs at 90 days, deleted-account data after the grace period. Verify cron jobs are actually running by checking deployment logs monthly.