Data Retention Policy Change & Deletion Readiness Review

The likely issue is a contract mismatch around data retention policy changes, deletion schedules, backups, logs, analytics, legal holds, customer exports, third-party processors, restore behavior, evidence, rollout, rollback limits, and ownership. I would first define the invariant: A retention change is ready only when every covered data copy, exception, hold, processor, restore path, and deletion proof is mapped to an owner and enforceable schedule without silently deleting protected data or retaining expired data. Then I would trace the smallest owning boundary, apply or propose a bounded repair/review step, and add deterministic normal, boundary, failure and replay tests. The workflow preserves existing authorization, privacy, security policy, public interfaces, user-visible behavior, and documented operational ownership. If repository/workspace files are available, findings can be mapped to exact paths and focused local validation; with partial evidence, the result stays an explicit diagnosis/evidence map with assumptions and no invented execution claims.