Audit intermediate Works with: Any AI

Data Retention Schedule Review

Json output Has example

Check how long personal data is kept and why.

The Open buttons send the prompt text as currently shown below to that site only when you click. Fill in the placeholders first.

[VERIFY] is an editorial flag, not a blank to fill. Wherever the prompt shows [VERIFY], check that item against a reliable source before you use it.

Help me review and structure a data retention schedule. This supports an internal review and is not legal advice. Organization type and regions: [ORGANIZATION_AND_REGIONS]. Categories of personal data we hold and where: [DATA_CATEGORIES_AND_SYSTEMS]. Current retention practice: [CURRENT_PRACTICE]. Legal or contractual retention requirements I know of: [KNOWN_REQUIREMENTS].

Return valid JSON only: an array with one object per data category. Keys: "category", "purpose", "systems", "data_subjects", "current_retention", "recommended_retention" (a duration or trigger such as "contract end plus six years"), "basis_for_period" (law, contract, business need, or "unknown, needs legal review"), "deletion_method", "owner", "risk_if_kept_too_long", "risk_if_deleted_too_early", "exceptions" (legal hold, disputes), and "open_questions" (array).

Rules: never invent a legal retention period; use "unknown, needs legal review" when I did not provide one and say who should confirm it. Flag categories kept indefinitely with no purpose.

After the JSON, add a plain-text summary: the five categories with the most risk, three quick wins for deleting data safely, and an annual review routine with who is responsible. Mark all legal points as [VERIFY].

What you produce is a draft for discussion and not legal advice. Confirm it with a qualified lawyer or privacy specialist who knows the rules in [JURISDICTION] before relying on it.

Fill in before use

Optional: type your details and the prompt above updates. Nothing is saved or sent.

Replace each bracketed placeholder with your own details, then paste into Any AI or another assistant.

{"category": "Job applicant CVs", "purpose": "Recruitment", "systems": ["ATS", "email"], "data_subjects": "Applicants", "current_retention": "Kept indefinitely", "recommended_retention": "6 months after the role is filled, longer only with consent", "basis_for_period": "unknown, needs legal review", "deletion_method": "ATS purge job plus manual email cleanup", "owner": "HR lead", "risk_if_kept_too_long": "Unnecessary exposure; right-to-erasure requests", "risk_if_deleted_too_early": "Cannot respond to a discrimination claim", "exceptions": ["legal hold"], "open_questions": ["Statutory period in our country?"]}
Top risk categories: applicant CVs (no deletion today), support tickets (kept forever), marketing lists (no record of consent date). Quick wins: schedule a purge for CVs, set a 3-year ticket archive, and add consent dates. Annual review owner: the operations manager. All legal periods marked for confirmation by a qualified adviser.

• retention
• records