Data Retention & Deletion Policy

This Data Retention and Deletion Policy ("Policy") establishes the mandatory framework governing how long data is retained, when and how it is securely deleted, and the review mechanisms that ensure ongoing compliance. This policy applies to all data, electronic, physical, or verbal, processed, stored, or transmitted by Brent Norris ("the Organization") on behalf of clients, prospects, and internal operations.

The objectives of this policy are to:

• Define enforceable retention periods for every category of data the Organization processes
• Establish secure, auditable deletion procedures that prevent unauthorized data recovery
• Ensure compliance with HIPAA, CCPA, IRS requirements, and general data protection best practices
• Minimize data exposure by retaining only what is legally or operationally necessary
• Provide a structured review cycle to adapt to evolving regulatory requirements

Non-compliance with this policy may result in regulatory penalties, breach of contractual obligations, or disciplinary action. All personnel, contractors, and third-party processors are bound by this policy.

This policy is designed to satisfy the retention and deletion requirements of the following legal and regulatory frameworks:

• HIPAA (45 CFR §164.530(j)): HIPAA-related documentation must be retained for 6 years from the date of creation or the date when it was last in effect, whichever is later
• CCPA (Cal. Civ. Code §1798.105): Consumers have the right to request deletion of personal information, subject to enumerated exceptions including legal obligations and ongoing service provision
• IRS Record Retention (26 CFR §1.6001-1): Tax-related financial records must be retained for a minimum of 7 years from the date of the relevant return
• SOC 2 Trust Services Criteria (CC6.5): Controls must exist for secure disposal of data when no longer needed
• NIST SP 800-88 Rev. 1: Guidelines for media sanitization providing approved methods for clearing, purging, and destroying data

Where regulations impose conflicting retention periods, the longest applicable period governs. Where no specific regulation applies, retention defaults to the Organization's operational schedule defined in Section 5.

Data is classified into the following categories, each with distinct retention and deletion requirements. Classification determines retention period, deletion method, and review priority.

The following retention schedule is binding. Data must be deleted within 30 days of the retention period expiration unless a legal hold or documented exception applies (see Section 8).

5.1 Client & Business Data

5.2 Security & Operational Data

5.3 HIPAA-Regulated Data

All deletion activities must follow the procedures below, selected based on data classification. No data may be deleted without verifying that the retention period has expired and no legal hold applies.

6.1 Electronic Data Deletion

6.2 Deletion Workflow

Every deletion action follows this four-step workflow:

1. Pre-Deletion Check: Verify retention period has expired, confirm no active legal hold, check for dependent records
2. Authorization: Restricted/Confidential deletions require AI Information Security Officer approval; Internal/Public may be automated
3. Execution: Apply the deletion method specified for the data classification, including backup purging
4. Verification & Logging: Confirm deletion success, generate disposal certificate (Restricted), write audit log entry with timestamp, scope, method, and authorizer

6.3 Backup Deletion

• Backup copies must be purged within 30 days of primary data deletion
• Point-in-time recovery snapshots containing deleted data expire per their defined retention window (7 days for daily, 30 days for weekly)
• Off-site backups are subject to the same deletion timelines as primary storage

Data subjects may request deletion of their personal information under CCPA (Cal. Civ. Code §1798.105) and general data protection principles. The Organization processes these requests as follows:

• Submission: Requests must be submitted to brentfm@gmail.com with subject line "Data Deletion Request"
• Identity Verification: Requestor identity must be verified before processing. Verification requires matching two of: email on file, phone number, account credentials
• Scope Assessment: Within 10 business days, the Organization identifies all systems containing the requestor's data
• Processing Timeline: Deletion completed within 45 calendar days of verified request. Complex requests may extend to 90 days with notice
• Confirmation: Written confirmation of deletion is provided to the requestor, specifying categories deleted and any exceptions applied

7.1 Permitted Exceptions to Deletion

The Organization may deny or partially deny a deletion request when data is required for:

• Completing a transaction or providing a requested service
• Detecting security incidents, protecting against fraud, or prosecuting offenders
• Compliance with a legal obligation (HIPAA, IRS record-keeping)
• Active litigation, legal hold, or regulatory investigation
• Internal uses reasonably aligned with consumer expectations

When an exception applies, the requestor is informed in writing with the specific exception cited, the expected retention period, and the date when deletion will proceed.

Legal holds override normal retention and deletion schedules. When a legal hold is issued, the following procedures apply:

• Issuance: Legal holds are issued in writing by the AI Information Security Officer or legal counsel, specifying the scope of data, reason, and anticipated duration
• Implementation: All automated deletion processes affecting in-scope data are suspended within 24 hours of issuance
• Documentation: A legal hold register records: hold ID, issue date, scope, authorizer, and status
• Review: Active legal holds are reviewed every 90 days to determine whether conditions still warrant the hold
• Release: Upon release, normal deletion schedules resume. Data past its retention period is queued for deletion within 30 days of hold release

This policy is enforced through the following accountability mechanisms:

Policy violations are treated as security incidents and handled per the Organization's Incident Response procedures. Consequences range from mandatory retraining to contract termination and legal action, proportionate to the severity of the violation.

The following technical controls are implemented to enforce this policy:

• Automated Purge Jobs: Scheduled database functions that identify and delete expired records based on the retention schedule (session data at 90 days, health checks at 1 year)
• Cascade Deletion: Foreign key relationships configured with appropriate cascade rules to prevent orphaned records
• Encryption Key Lifecycle: Credential encryption keys stored in isolated vault services with 90-day automated rotation; old keys destroyed upon rotation
• Row-Level Security: Database RLS policies prevent unauthorized access to data pending deletion, ensuring only admin-role users can execute deletions
• Immutable Audit Trail: Security audit log records all deletion events with timestamp, actor, method, and scope. Audit logs themselves have no DELETE policy for non-admin users
• IP Address Hashing: IP addresses are stored as SHA-256 hashes, never in plaintext, minimizing PII exposure in operational logs

Compliance with this policy is verified through the following audit activities:

Audit findings are documented in the Organization's risk register and tracked to resolution. Critical findings require remediation within 30 days.

This policy is subject to the following mandatory review cycle:

All review outcomes are documented with: reviewer name, review date, findings, recommended changes, and implementation timeline. Changes to retention periods require documented justification and ISO approval before taking effect.

This policy operates in conjunction with the following Organization policies. In the event of conflict, the most restrictive requirement applies.

• Information Security Policy - Overarching security framework, access controls, incident response
• Privacy Policy - Data collection disclosures, legal basis for processing, individual rights
• Compliance Services - HIPAA, regulatory compliance service offerings

For questions about this policy, data deletion requests, or to report a retention violation, contact: