Retention rules are policies that define how long records must be kept, when they must be archived, and when they should be securely deleted. In cyber security, they are a core part of data governance because stored information remains a liability: old files, logs, backups, and exported documents can expose sensitive data long after they stop being operationally useful.
Strong retention rules reduce attack surface by limiting how much data an attacker can steal and how long it remains available. They also support investigations and compliance by preserving evidence in a controlled archive, often with legal holds and audit trails. Weak or inconsistent retention can lead to over-retention, incomplete deletion, or missing records, all of which can create security, privacy, and accountability problems. In real defenses, retention schedules are paired with encryption, access controls, and verified disposal so records are kept only as long as necessary and no longer.