My scenario: A production facility that uses data sets provided by customer(s) to produce personalized goods in bulk. Data sets can range from 100,000 to 2,000,000 names and addresses in the US. This isn’t PCI and doesn’t fall under HIPPA or Sarbanes-Oxley Act.

In a job shop environment, how long is too long to keep data lists provided by customers? Project Managers would love to keep “everything” indefinitely to refer to. Network admins would like data sets scrubbed once a project has shipped.

I’d like to have a solid balance. What are some of the best practices in this area and sources that you refer to for setting policy?

3 Answers 3


Never hold anything for longer than you absolutely need it. Your factors in how long that is can include:

  • legal requirements
  • financial reporting requirements
  • regulatory requirements
  • contractural requirements
  • legitimate business reasons

I think that the US as a 10-year requirement for financial reporting (it's been a while so I might be wrong).

Your contracts might require longer periods in order to satisfy your obligations.

Yes, there are many who want data "indefinitely", but then they have to define a legitimate reason for it (and that reason will have to stand up to outside scrutiny).

Privacy regulations, in general, have the understanding that personal data must be destroyed when no longer needed. And they have a dim view of "we might find a need later".

Here's your rule of thumb: "personal data is a toxic asset". It holds more financial liability than benefit. You tend to only keep it because you are forced to. But after you no longer need it, and as the benefit shrinks over time, you are just left with a liability.


In addition to schroeder's good answer, it helps to work with the Project Managers to identify why they need the data. What do they use old data for? Does it save them time? Does it provide a shortcut for return customers? Does it produce valuable business intelligence? Does it allow you to re-run a job in case of a mistake?

Once you know how they plan to use it, you can figure out what to do with it. If they save it because it saves returning customer's time, perhaps you could create a template that would do the same thing. If they're looking for business intelligence, make it a part of the process to summarize or anonymize the data once the project is over, then destroy the data. If it's added to a pool of data for simulations or modeling, find a way to add the non-personal information to the pool and discard things like names and street addresses.

If they're storing the data to rerun a job to potentially correct a mistake, ask the project managers to supply information such as how frequently these mistakes happen, how much rework is typically needed, if they need the data or if the customer can re-supply it, and what's the policy on the maximum time before a customer discovers the mixup and complains? That data will be vital to establishing a data retention policy.

It's also possible they store the data because it's a convenience for some of their clients, and the clients like having your company store their data. Maybe that becomes a part of each order/contract to specify how long you'll retain their data after the job is finished.

Regardless of why, it sounds like you could use a corporate Information Security Policy that defines things like requiring data retention policies, classifications of sensitive data, etc.

Until you have an official policy, help them understand that storing Personally Identifiable Information (PII) longer than you have to is literally dangerous to your company. Someday a hacker may breach your organization, steal a copy of the data, and put you in the national news. When it happens, it doesn't matter if you thought the data was sensitive or not, because your customers will always see it as a breach of their trust.


While John Deters and Schroeder have covered most of the points, it is basic data hygeine that any information you capture should have a planned lifecycle. That's not just about deciding how long you are going to keep it, but having the mechanisms in place to capture its age/planned retiral date and a way of removing the data.

That you don't know how long to keep data strongly suggests these mechanisms may not be in place.

And what is "legal" to keep today might not be legal tomorrow.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .