A regulatory obligation rather than housekeeping. The retention period runs from closure, so closure has to be dated and the file has to be complete at that point.
A disposal date is set at the same time. Retention without disposal is not compliance, it is hoarding, and it converts an obligation to keep records into an unbounded data protection liability.
Open, 2 item(s)
State
What
Position or reason
Owner
assumed
RUL-61 The engagement file is complete at closure
Assumed. Completeness is reviewed by sampling rather than enforced.
Quality Lead
assumed
RUL-64 Client data leaves the EU hosting region only with a lawful basis
Assumed. The screening platform is hosted in a different jurisdiction from everything else (see SYS-SCRN).
Data Protection Officer
Boundary
Trigger (in)
A closed engagement.
Output (out)
The engagement file archived, with a retention period and a disposal date set.
Requires
engagement-closed
Produces
records-retained
Floor: can this run itself
Position
unattended
Manual because
n/a
Basis
Archive, retention calculation and disposal date are all automatic from the closure date. The obligation is absolute, which makes it a good candidate for automation.
Confirmed by
nobody named
Behaviour: what runs it
Systems
Archive and retention, Engagement register
Data
Dataset
Authoritative source
Also in
State
Owner
Retention record
Archive and retention
settled
Data Protection Officer
Work product
Work product
S, Y, S, -, D, M, S, -, A, R, C, H
settled
Quality Lead
Engagement
Engagement register
General ledger, Pipeline
settled
Engagement Lead
Rules: what is decided here
ID
Rule
State
Enforced by
Basis
Owner
RUL-61
The engagement file is complete at closure
assumed
Quality Lead role
Assumed. Completeness is reviewed by sampling rather than enforced.
Quality Lead
RUL-62
Retention runs from the closure date
defined
Archive and retention
Calculated at archive.
Data Protection Officer
RUL-63
Every archived file has a disposal date
defined
Archive and retention
Retention without disposal is an unbounded liability, not compliance.
Data Protection Officer
RUL-64
Client data leaves the EU hosting region only with a lawful basis
assumed
Data Protection Officer role
Assumed. The screening platform is hosted in a different jurisdiction from everything else (see SYS-SCRN).