RETENTION GUIDE

How to Build a Personal Data Retention Schedule

Translate legal, regulatory and operational requirements into defensible retention periods, review rules and deletion controls.

Use the working sequence below to connect the decision to operating implications, retained evidence and the point where specialist DPO support may be required.

Prepared by DPO Arabia

Practical KSA PDPL guidance, not organisation-specific legal advice.

KSA PDPL GUIDE

Turn retention obligations into enforceable lifecycle rules.

The Guide frames how retention periods, triggers, legal or operational justification and end-of-retention treatment should be established. The organisation-specific conclusion should be validated before implementation.

USE THIS WHEN

Use when retention rules are missing, inconsistent or disconnected from systems.

This becomes relevant when building the first schedule, reviewing legacy periods, introducing new systems or changing legal and business requirements.

HAVE READY

Bring data categories, systems, owners and existing retention requirements.

Useful inputs include processing purposes, legal obligations, contracts, business needs, backups, archives, processors and destruction methods.

OUTCOME

Finish with an approved schedule that can be implemented across the data lifecycle.

Each retention rule should have a basis, owner, trigger, disposal method and evidence that the rule can be enforced.

HOW TO USE THIS GUIDE

Use the Guide to frame the decisions before implementation.

This Guide highlights the decisions, evidence and operating interfaces that should be resolved before the requirement is treated as complete.

Use it to understand the issue, challenge the relevant facts and identify where organisation-specific legal, operational or technical input is needed.

GUIDE OUTCOME

An approved retention schedule that can be enforced across systems, processors, backups and destruction workflows.

The objective is a defensible decision and an operating control, not simply a completed template or document.

QUESTIONS TO RESOLVE

What should the DPO Office establish?

RETENTION DECISION CHECKPOINT

What Personal Data record categories does the organisation actually retain?

What legal, regulatory, contractual or operational requirement supports each retention period?

What event starts the retention clock for each record category?

Can the organisation apply the same rule across systems, processors, archives and backups?

Can deletion, anonymisation or destruction be evidenced, including where an exception temporarily prevents it?

WORKING STEPS

Use the sequence to identify the decisions that need to be resolved.

Inventory record types

Identify the Personal Data records maintained across business processes, systems, processors and archives. Build the schedule by record category and business activity rather than applying one generic period to all Personal Data.

What to validate in practice

DPO Arabia service

WHAT NOT TO DO

Do not assign one default retention period to unrelated Personal Data. Validate the actual record category, purpose and retention requirement before setting the rule.

Determine the requirement

Map the legal, regulatory, contractual and documented operational reasons that justify retaining each record category. Record the source supporting the requirement and distinguish mandatory retention from internal business preference.

What to validate in practice

Identify any statutory, regulatory or contractual retention requirement and the source that supports it.
Where no prescribed period exists, document the operational need and why continued identifiable retention is necessary.
Check legal-claim, dispute or investigation considerations and whether different record categories need different retention triggers.

DPO Arabia service

DPO CHECK

Separate a genuine retention requirement from convenience. If the purpose has ended, Article 18 and the destruction rules should drive the next decision.

Set the period

Define the retention trigger and duration together. A period such as “10 years” is incomplete unless the schedule also states the event from which the period runs and how the rule is enforced across systems and copies.

What to validate in practice

Define the retention trigger, such as account closure, employment termination, transaction date or completion of the relevant activity.
Record the duration, start and end points, and test whether the period is longer than necessary for the stated purpose or legal requirement.
Validate system capability, Processor retention, backup retention and archival copies so the approved rule can be applied consistently.

DPO Arabia service

OPERATING TIP

Record both the retention trigger and the duration, then link the rule to the relevant Record of Processing Activities (RoPA) activity and system so the period can be understood and enforced.

Define destruction

Specify what happens when the approved retention period ends. Define an irreversible destruction method, the systems and copies in scope, Processor responsibilities and the evidence that will demonstrate completion.

What to validate in practice

Define the deletion or destruction method and confirm that it renders Personal Data permanently inaccessible and unrecoverable where destruction is required.
Include primary systems, archives, backups and Processor-held copies, and assign the technical or operational owner responsible for execution.
Retain destruction evidence and remember that archiving or backup does not itself constitute destruction.

DPO Arabia service

OPERATING TIP

Review the destruction method when systems, storage architecture, processors, backup arrangements or technical capabilities change.

Manage retention exceptions and legal holds

Document circumstances that temporarily prevent normal destruction, such as a legal hold, regulatory preservation requirement, active investigation, dispute or technical constraint. Keep every exception time-bound, owned and reviewable.

What to validate in practice

Record the reason for the exception, accountable owner, approval and the Personal Data or record categories affected.
Define the revised destruction date or review point and ensure the exception is limited to the data genuinely required for the stated reason.
Periodically reassess the exception and retain evidence of eventual destruction once the hold or other constraint ends.

DPO Arabia service

OPERATING TIP

Track legal holds and other exceptions as active governance items with an owner and review date, not as permanent reasons to retain Personal Data indefinitely.

EVIDENCE TO RETAIN

Know what evidence should remain after the work is complete.

Retain the approved periods, legal and business rationale, owner validation, system mapping, exceptions and destruction evidence that support each retention rule.

RETAINED EVIDENCE SET

Keep each retention period tied to its rationale, trigger and accountable owner.

Retain destruction evidence and approved exceptions across systems and Processors.

Approved Personal Data Retention Schedule

Record-category inventory

Legal / regulatory source references

Retention rationale

Retention trigger

Approved retention period

System and application mapping

Processor retention requirements

Backup / archive treatment

Destruction method

Destruction evidence

Exception / legal-hold register

Exception approval and review date

Change and version history

BEFORE YOU CLOSE THE WORKFLOW

Validate the operating position, not only the document.

Before closing the retention review, confirm that every material data category has an approved period, a clear trigger, an accountable owner and a practical disposal method across live systems, backups and processors.

Use the checks below to test whether the schedule can actually be applied, monitored and evidenced rather than existing only as a policy document.

The processing facts have been validated with the accountable business owner. The applicable KSA PDPL requirement and decision rationale are documented. Required actions, safeguards or contractual controls have identifiable owners. Supporting evidence is retained in the DPO Office source of truth. A review or reassessment trigger is defined where the activity may change.

FROM GUIDANCE TO OPERATION

Connect the decision to the wider DPO Office.

A retention schedule becomes operational when approved periods are translated into system rules, deletion workflows, processor instructions, backup handling and recurring review. Use this handoff to connect the schedule to those controls.

Apply the DPO guide

Use the guide to define retention periods, validate the rationale, map implementation points and document exceptions and destruction triggers.

Connect the controls

Connect each retention rule to the relevant RoPA activity, system, Processor agreement, Privacy Notice, backup control, destruction method and exception record so the approved period can actually be enforced.

SPECIALIST SUPPORT

Get specialist support

Use DPO Arabia to build or remediate the schedule, challenge unsupported periods, align retention across systems and processors, or establish destruction evidence.

GUIDE STEPS

Use these sections as your working path through the DPO guide. If a processing fact is unknown, record it for clarification rather than guessing.

How to use this guide

Questions to resolve

Working steps

Inventory record types

Determine the requirement

Set the period

Define destruction

Manage retention exceptions and legal holds

Evidence to retain

Before you close

From guidance to operation

READY TO OPERATIONALISE IT?

Need to turn the guidance into an operating DPO Office control?

DPO Arabia can apply the Guide to your organisation’s actual processing, decisions and evidence, then implement and operate the resulting control through the appropriate DPO Office service.