Request Trial Get Started

Retention Management

Expand All

The Retention Management feature is designed to help organisations streamline their data privacy retention processes while avoiding duplicate data entries. This feature, accessible under Data Privacy and Protection (DP&P) in the left navigation, allows users to manage retention policies efficiently and integrates data from Records of Processing Activities (RoPA) and Data Protection Impact Assessments (DPIA) to centralise retention requirements.

Effective retention management is essential for organisations to meet regulatory obligations, protect sensitive data, and ensure that information is managed responsibly throughout its lifecycle. Retention management helps organisations define and enforce policies for storing, archiving, and securely disposing of data in alignment with legal, compliance, IT, and operational requirements. By centralising retention policies, organisations can minimise the risk of retaining outdated or unnecessary data, reducing exposure to data breaches and improving data governance.

Retention management also supports data minimisation principles, ensuring that personal data is retained only as long as necessary. By clearly defining retention periods and regularly reviewing them, organisations can improve operational efficiency, enhance data security, and reduce storage costs. As data protection regulations increasingly mandate strict retention policies, effective retention management is a critical component of an organisation’s data protection and privacy strategy.

Access to Retention Management is included as part of 9ine’s Privacy Platform licence. For further information contact [email protected].

Accessing retention management

Upon purchasing 9ine’s Privacy Platform and its associated features, users can be granted access to Retention Management. Your organisation’s 9ine Platform administrator(s) have the option to allocate permission via User Management available in the header.

Granting access to this feature does not automatically provide access to all retention management items. However, it allows users to log a new retention management item. Users must be added as the owner, members, or notified users to gain edit access. Owners and members of any risks, issues, lessons or tasks are also granted edit access if associated with a retention management item.

A retention management items permissions include:

Owner
Member(s)
Notified user
Attachment reviewer

There can only be a single owner of a retention management item but there are no limits to the number of members or notified users. Each attachment can also have one reviewer. Owners can edit and delete their items, while all other roles have edit rights but cannot delete. When more than two members or notified users are added, the additional user details are combined into a single pill, which can be clicked to view further details. These pills are alphabetically ordered.

Retention management items can be deleted by the owner. If the item is linked with a record of processing activity and/or a DPIA, the record of processing area owner, record of processing activity owner, and DPIA owner also have delete permissions.

Warning:

If a retention management item is linked to a record of processing activity and/or DPIA, the area owners and members are granted access. Similarly, the record of processing activity and/or DPIA owner, member, reviewer, approver, attachment reviewers, notified users, and DPIA screening reviewer gain access.

Tip:

When creating or associating a retention management item with a record of processing activity or DPIA, the owners and members from the linked item are automatically copied to the retention management item. While you can change the owner of the retention management item, the original owner from the associated item must remain as a member. Additionally, you have the flexibility to add other members outside of those originally copied from the record of processing activity or DPIA.

Adding and removing notified users

Mention User (@)

To add a notified user, use the mention function in either the description field ...

To add a notified user, use the mention function in either the description field on the Details tab or the notes field on the Notes tab.

To begin, click the @ symbol on your keyboard and type the first name of the user you wish to mention.
A user can be mentioned at the start, in the middle, or at the end of the entered text.
To remove a user as a notified user, simply delete their name from the relevant note.
Mentioning a user sends an in-Platform notification and an email unless the user has disabled email notifications.
The email notification sends a complete copy of the text entered by the user in the 9ine Platform, to the user’s registered email address.

Step 1:

Step 2:

Understanding how to create a retention management item

There are three ways to create a retention management item:

By clicking New in the Retention Management log.
By clicking Add Retention on the Processing Overview step of a record of processing activity form.
By clicking Add Retention on the Processing Description step of a DPIA form.

When clicking either of the options, you will then be presented with a popup which displays a mandatory field Title.

When adding a retention item from a record of processing activity or DPIA, the Association, RoPA / DPIA, Owner, and Member(s) fields are pre-populated with the relevant information.

Tip:

You can associate a retention management item with additional records of processing activities and/or DPIAs by searching by reference number or title in the RoPA / DPIA field. When linking to multiple forms, each form’s permissions are applied to the retention management item, but permissions are not shared across forms. For example, if retention management item 1 is linked to DPIA 2 and DPIA 3, users with access to DPIA 2 and DPIA 3 gain access to retention management item 1. However, users of DPIA 2 will not have access to DPIA 3 and vice versa.
You also have the option from the record of processing and DPIA forms to use the dropdown available next to the Add Retention button to quickly associate the form with a retention management item.

Creating a new retention management item or editing an existing one

When creating a new retention management item or editing an existing one, you will be directed to a standardised popup accessible from the retention management log, the record of processing activity form, or the DPIA form. The first tab allows you to capture and view key details associated with the retention, including the title, number, what is the retention period for the personal data being processed, owner, members, notified users, frequency, retention type, retention exception, method of destruction, retention method, and status. If you wish to add an infinite retention a checkbox is provided, which automatically disables the Retention Period field. You can enter the retention period using the format Years (y), Months (m) and Days (d), for example: 1y 2m 6d.

Additionally, you have the option to specify a Next review date to ensure timely review of the retention policy.

Calendar Field

When selecting a date, you can manually type in the specified format or click on

When selecting a date, you can manually type in the specified format or click on the date in the header to quickly navigate through months or years. The clear button allows you to easily remove any entered date.

When the date entered in either of the date field lapses, a warning message is displayed. Similarly, lapsed dates are shown in red on the moduleName log.

Tip:

To access retention data linked to a record of processing activity or DPIA form, go to the retention management log or view the details in the retention management popup within each form. Note that this retention information is not directly visible in the records of processing or DPIA logs.

Utilising the notes and attachments features

Notes Tab

The

The Notes tab allows you to maintain a single repository of information. You can add multiple notes at once using the Add Another function, but these notes are not saved until you click the primary Save button at the bottom of the popup.

When adding a new note, a record of the user's details, date, and time of entry are added, and the most recent notes will automatically appear at the top of the list. If an individual note is edited, the time and date of the note are updated, and the note reordered.

Additional formatting functionality is provided on the notes tab. If entering large volumes of data, click the Full Screen option.