Retention and Archiving Schedule Builder
A records retention schedule that works for incident response: record type, legal basis, retention period, archive tier, deletion method and legal-hold override, with security logs kept long enough to find out when an intrusion actually started.
Template & sample only — a structured starting point with sample content, not legal, audit, certification or investment advice.Customise it with your own details for free; exporting the generated document is part of Pro.
Build a retention schedule: for each record type, the legal basis or business reason, how long it is kept, where it is archived, how it is deleted and whether a legal hold can stop the deletion. Security logs are included on purpose: if logs expire before an intrusion is found, nobody can say when it started or what was taken. The calculator flags short log retention, automated deletion with no legal-hold override and rows with no reason or period.
Your context
Retention schedule
One row per record type. Write the period as a number and unit (90 days, 13 months, 7 years) so the calculator can read it. Sample periods are illustrative; legal requirements differ by country and sector.
Control requirements
Security logs are kept for at least 12 months, with the most recent 90 days searchable immediatelyPCI DSS v4.0 Req. 10.5.1material
Log sources needed for investigations are listed and covered: identity, VPN and remote access, firewall and DNS, EDR, email, cloud audit, SaaS admin
Archived logs and evidence are protected from change or deletion (write-once storage or equivalent) and access is logged
A legal-hold process can suspend deletion for named systems, people or date ranges within one business daymaterial
Personal data is not kept longer than needed for its purpose, and each period has a recorded reasonGDPR Art. 5(1)(e)
Deletion is automated where possible, and manual deletions are recorded with date and approver
Suppliers holding your records follow the schedule, and return or delete data at contract end with confirmation
Archived data can be restored and searched within the time an investigation needs; this is tested yearly
The schedule is reviewed yearly and when a new system, regulation or business line is added
Policy text
What this template gives you
- Retention schedules are usually written for privacy and tax. This one is written so an incident investigation still has the evidence it needs.
- Security logs are kept for at least 12 months in the sample because attackers often go unnoticed for weeks or months; if the logs expire first, nobody can say when an intrusion began or what was taken.
- Every row has a legal-hold override. The calculator flags automated deletion that a hold cannot stop.
- Sample periods are illustrative. Confirm each one with counsel for your countries and sector.
Frequently asked questions
How long should security logs be kept?
At least 12 months is a common baseline, with the most recent 90 days searchable immediately. PCI DSS asks for 12 months of audit log history with 3 months immediately available where it applies. The reason is practical: intrusions are often found weeks or months after they start, and an investigation needs logs from before the start.
What is a legal-hold override?
A way to suspend deletion of specific records when counsel expects an investigation, claim or regulatory inquiry. Without it, automated expiry can destroy evidence you are legally required to keep. The override must reach every system that deletes automatically, including log platforms and backups.
Does keeping logs longer conflict with GDPR?
Not if there is a recorded reason. GDPR's storage-limitation principle requires that personal data is kept no longer than necessary for its purpose. Security monitoring and incident investigation are recognised purposes; record the reason and the period, protect access to the logs, and delete them when the period ends.
Is this a finished document I can rely on?
No. Every tool in this suite is a template with sample content. It gives you a structured, editable starting point and generates a document from your own answers, but it is not legal, audit, certification, investment or professional advice. Review and adapt the output, and have it checked by the appropriate specialist before you rely on it.
Who can use it?
Anyone. Using it and customising it with your own details is free, and your work is saved in your own browser. Exporting the generated document (Word, PDF, Markdown, CSV) is part of any PlayCISO paid plan.
More free security tools
The tools people use most on PlayCISO.
Catch injected instructions hiding in content your AI agent should only read.
Score your readiness against the first international standard for AI security threats.
Critical CVEs across 21 major vendors, month by month — and what the 2026 surge means.
Build an ordered ruleset, replay labelled packets and catch shadowed and any-to-any rules.
Self-assess all six Functions, from Govern to Recover, and see your weakest one.
Search 172 threat actors across Microsoft, CrowdStrike, Mandiant and community names.