Retention
Retention windows that survive audit
Most analytics teams can recite a retention slogan. Far fewer can show the clock that enforces it. Auditors — and increasingly, internal privacy partners — ask for triggers, owners, and proof that deletion actually ran. Screenshots of a settings panel rarely close the question.
Separate purpose from storage
Product analytics often mix behavioral events, support diagnostics, and marketing attribution in one warehouse schema. Retention fails when every table inherits a single “two years” rule. Start by labeling each stream with the decision it feeds. Support replay may need shorter windows than yearly cohort studies. Write those differences down before you automate anything.
Define the trigger, not only the duration
A window of thirteen months is incomplete without the event that starts the clock: last open, account closure, consent revoke, or ingestion date. Pick one primary trigger per stream and document exceptions. Campaign teams will ask to keep “just the aggregations.” Agree in advance whether aggregates may outlive row-level events and how identifiers are stripped.
Evidence beats aspiration
Schedule a monthly export of deletion job logs into a folder privacy can access without paging an engineer at midnight. Include row counts before and after, job IDs, and the policy version applied. In Analytics Stewardship Studio we rehearse presenting that packet in under five minutes — because audits reward clarity, not volume.
When product wants an extension
Extensions should be tickets with expiry dates, not Slack shrugs. Require a named executive sponsor, a narrowed data subset, and a new deletion date. If your culture cannot say no, governance remains theatrical.
Ready to pressure-test your windows? Browse the course desks or contact the studio.