A few years back I got a breach notification from a company I hadn’t been a customer of for twenty five years. My first reaction wasn’t fear. It was a genuine question: why do you still have my data at all? The only plausible reason is that it was sitting in a database somewhere, useful for nothing except a faint chance it might one day help with marketing.
That’s not a story about one company being careless. It’s the default state of most data in most organisations.
Nobody Decided To Keep It. It Just Never Got Removed.
When people picture a retention failure, they picture a policy that got it wrong. The far more common failure is that no policy was ever applied at all. Data doesn’t usually stay because someone judged it worth keeping. It stays because deleting it requires someone to notice it, understand it, and take responsibility for removing it. That chain breaks somewhere, every time, by default.
It’s also worth being honest that data which has outlived its purpose is often the worst quality data you hold. Twenty five years ago my address, my job and my contact details were all different. The usual defence, “we might need it one day,” rarely survives contact with the data itself.
The Real Cost Is Not Being Able To Answer For It
If old data is ever exposed, the damage isn’t limited to the leak itself. It’s that nobody can answer what follows: why did we have this, who do we need to tell, what else is exposed. An organisation that only keeps data it has an active reason for can answer those questions in a morning. One that’s been quietly accumulating everything for two decades can’t answer them at all.
Three Questions Worth Asking About Any Set Of Data
- Why do we have this, specifically, right now?
- Who would we need to tell if this were exposed tomorrow?
- Would the person it’s about recognise why we still have it?