Data retention controls are the policies and technical settings that decide what a system stores, how long it keeps it, and whether users can delete it. In practice, they cover retention periods, automatic expiry, deletion workflows, backups, and which data is kept only in temporary memory versus long-term storage. For AI systems, this matters because prompts, chat history, profiles, and preference data can quickly become sensitive records.
Weak retention controls increase cyber risk by expanding the amount of data that can be stolen, misused, or exposed through an internal mistake. Overretained content can also reveal health details, relationship information, credentials, or other personal disclosures from past conversations. Defenders reduce that risk with data minimization, clear user-facing deletion options, short TTLs, separation of session context from stored memory, and audit logs that show what was kept and why. In attacks, criminals may target retained conversation archives or backups precisely because they contain more context than a single live session.