How do you handle data retention and compliance for stored data?

Question

Accepted Answer

The senior framing is that stored data is a liability, not just an asset, so I do not default to keeping everything. I define retention per data type from legal and business requirements, how long must this be kept and, just as important, when must it be deleted. Then I automate it with lifecycle rules, so debug logs might expire after 30 days, application logs after 90, and financial records sit for the 7 years the regulator wants. Data does not accumulate forever by inertia. The reason is risk as much as cost. Every record you retain is something a breach can expose and something you may have to account for, so data minimization, keeping only what has a purpose and only as long as needed, is a security and compliance posture, not just a storage bill optimization. Then the compliance controls. Where regulation says data must be retained unaltered, financial records for instance, I use legal hold and WORM immutability so nothing can be deleted or tampered with inside the retention window, and I audit access to sensitive data. Privacy law is a real engineering requirement too. Under GDPR right to erasure I typically have 30 days to actually find and delete a specific user, which is brutal if data is scattered across services and buried in backups, so it has to be designed for. And residency means keeping data in the regions the law requires, which constrains where I store and replicate. So, retention policies with automated deletion, data treated as a liability, WORM and legal hold where required, and erasure and residency built in, not hoarding because storage looks cheap.

Answer

Why is keeping all data indefinitely a problem beyond cost?

It is a liability: a breach exposes everything you retained, and regulations (GDPR) may require deletion. Data minimization, keep only what has a purpose for as long as needed, reduces breach exposure and compliance risk.

Answer

What makes GDPR right-to-erasure technically hard?

You must locate and delete a specific user data everywhere it lives, including backups, replicas, and derived datasets. If data is scattered or backups are immutable, that requires deliberate design (e.g. crypto-shredding, mapping data to users).

How do you handle data retention and compliance for stored data?

How do you handle data retention and compliance for stored data?

The follow-ups they ask next

What the interviewer is listening for

What sinks the answer

If you genuinely do not know

Keep going with storage

Knowing the answer is not the same as recalling it under pressure