Data Retention Schedule Builder

Managing records retention is a compliance minefield of conflicting jurisdictional laws, operational needs, and technical constraints. This skill converts fragmented record inventories and internal policies into source-traceable, review-ready retention schedules. It moves beyond simple spreadsheets by mapping every record class to its specific start trigger, evidence-backed duration, and disposal verification method.

What it does

• Inventory Mapping: Creates structured records lists including data sensitivity, owners, custodians, and primary/secondary storage locations.
• Evidence Hierarchy: Categorizes retention drivers by verified primary rules (Grade A), management assertions (Grade B), or planning assumptions (Grade C).
• Trigger Definition: Establishes precise retention start events such as contract termination, employee exit, or financial year-end to replace ambiguous dates.
• Hold Orchestration: Identifies active litigation or investigation holds to prevent accidental disposal of protected evidence.
• Disposal Planning: Defines actionable destruction methods per medium, including secure-wipe protocols and chain-of-custody verification.
• Gap Analysis: Generates an implementation action plan and an assumptions register to flag unverified legal claims.

How it works

1. Scope Definition: Provide the jurisdiction, sector, and record categories to establish the compliance boundary.
2. Data Input: Supply anonymized record samples, policy excerpts, or system lists to populate the schedule.
3. Drafting and Mapping: The skill builds the decision register, mapping lawful bases to specific retention rationales and technical locations.
4. Audit and QA: Run the review mode to test existing rows for logic conflicts, citation accuracy, and disposal feasibility.

Frameworks & tools

This skill is designed for privacy teams and compliance officers working with records management systems, cloud storage (AWS/Azure/GCP), and physical archives.

Why this beats prompting it yourself

Generic prompts often default to "seven-year" blanket rules or fail to distinguish between the lawful basis for processing and the legal requirement for retention. This skill enforces a strict evidence hierarchy and trigger logic, ensuring no record is marked "approved" without a verified source or specific owner sign-off.

Use cases

• Consolidating fragmented record lists from multiple departments into a single source of truth.
• Mapping retention obligations for multi-jurisdictional organizations with conflicting laws.
• Preparing a disposal-control plan for IT teams to configure automated deletion cycles.
• Reviewing legacy retention policies to identify risks like missing legal holds or uncontrolled backups.

Known limitations

Does not provide binding legal advice or certify regulatory compliance. Cannot execute data deletion directly or verify external laws without user-provided evidence or authorized research.