The situation
Keeping information indefinitely may feel convenient. It also increases the amount of data that could be exposed, complicates privacy compliance and makes it harder to explain why information is still being held.
In a life-sciences context, excessive data-retention practices were identified as a source of privacy, cyber and regulatory exposure.
The decision
What information is being retained? Why is it needed? Which legal or business requirements apply? Who should decide when data is deleted, archived or subject to additional safeguards?
What the experience demonstrates
A useful data-retention review connects privacy requirements with the actual systems and teams holding information. The work is not merely about writing another policy: it involves identifying unnecessary retention and making practical recommendations about data handling and responsibility.
What can change
In the documented historical example, identifying and addressing excessive retention reduced exposure to potential data leakage, cyber breach, regulatory and reputational risk.