Draft Data Retention Policy

Operational draft requiring legal and institutional review before public launch.

Academic, attendance, financial, payroll, security, and communication records should be retained only for the period required by institutional policy and applicable law.

Deletion must preserve required audit trails, legal holds, payment records, and backup-expiration schedules. Expired backups must be removed through a controlled process.

Each institution must document its retention periods, responsible owners, export procedures, deletion-request workflow, and exceptions before onboarding real users.