What is data retention and destruction?
Data retention defines how long each kind of data is kept and why. Data destruction is how data is securely deleted once that period ends or a customer asks for it, including copies in backups. Together they limit how much data could be exposed in a breach.
What the buyer is really asking
How long do you keep the buyer's data, what happens to it when the contract ends, and do backups follow the same rules? Many buyers paste your answer straight into the DPA, so be exact.
Other ways buyers ask it
Every one of these wants the same answer:
- “What is your data retention policy?”
- “What happens to our data when the contract ends?”
- “How long are backups retained?”
- “Can you certify deletion of our data?”
Evidence to have ready
- A data retention and disposal policy
- Backup retention settings
- The deletion process at contract termination and any certificate you provide
How Tyrvar answers this
Tyrvar treats every wording above as one question. You write the answer once, attach the evidence, and revisit it when your setup changes. Each buyer gets that approved answer no matter how their questionnaire words it. If you have not answered it yet, Tyrvar flags the question for you and does not make something up. Try it on your own questionnaire.