A retention rule is a policy that defines how long data is kept before it is deleted or archived. It may apply to emails, logs, backups, employee records, survey responses, or security telemetry. Good retention rules help organizations balance business needs, legal obligations, and privacy requirements.
In cyber security, retention matters because old data becomes extra exposure. The longer sensitive records remain stored, the more time attackers have to find them through a breach, misconfiguration, insider misuse, or a compromised account. Defenders use retention rules to reduce the amount of valuable data sitting in systems, limit the blast radius of incidents, and support data minimization. Clear rules also help incident responders know which logs and records should still exist when investigating suspicious activity, while ensuring unnecessary personal data is removed on schedule.