A retention schedule is a documented policy that sets how long an organization keeps each category of data and what happens afterward, such as deletion or archival. It usually reflects operational needs, legal obligations, and regulatory requirements.
In cybersecurity, retaining data longer than necessary increases the amount attackers could access or steal, including information in legacy systems and backups. Clear schedules help teams reduce that exposure and identify what historical data remains during an incident. Defenders should inventory data stores, apply deletion or archival rules consistently, and include retained archives in access controls and incident-response planning.