Individual skill

data-retention-policy

Build a data retention and deletion schedule grounded in legal basis. Use when asked to create a data retention policy, set retention periods, plan data deletion/minimisation, or answer 'how long can we keep this data?'. Produces a retention schedule — data categories with their retention period, legal/business basis, deletion trigger and method, plus flags for data kept with no basis or no defined period.

plugins/pm-compliance/skills/data-retention-policy/SKILL.md

Read pinned source

Source commit f7c90bc09ee05dc25cf257bdb1826f2c2552c2cb

What was checked

Matches the observed repository HEAD
Yes
Scanner rules are current
Yes
Repository scan complete
No
Skill scan complete
No
Observed behavior
Network or broad shell
Last checked
Nov 9, 2026

These are observations at the recorded commit, not a guarantee of safety. Review the source before running it.

Install this skill

Choose an agent in your Stack or copy a command below. Commands fetch the pinned commit and copy only this skill directory. Existing destinations are refused. Copying a command does not install anything.

An install command is unavailable: current rules, complete repository and skill scans, an eligible behavior level and a permitted license are required.

Repository context

Repository stars (not skill ratings)
1,539
Repository last updated
Nov 10, 2026
License
MIT

Observed agent integration: No specific integration evidence. Standard SKILL.md installation does not imply verified compatibility.

Files and excerpt

File metadata and permitted, redacted excerpts come from the recorded scan. Source links are pinned to that commit.

Browse files
Read excerpt

# Data Retention Policy Skill

"Keep everything forever" is a liability, not a strategy — it grows breach exposure, violates data-
minimisation rules (GDPR, CCPA), and turns every data subject request into an archaeology project. This
skill builds a retention schedule that ties each data category to *how long* you keep it and *why*
(legal basis), with a concrete deletion trigger — so retention is a defensible policy, not an accident.

## Required Inputs

Ask for these only if they aren't already provided:

- **Data categories** — the kinds of data you hold (customer records, logs, financial, HR, marketing, backups).
- **Legal/regulatory drivers** — anything mandating minimum retention (tax/financial records, employment law) or maximum (GDPR minimisation, sector rules).
- **Business need** — why each category is genuinely needed and for how long.
Back to top