Retention nobody can shorten
You decide how long final documents are retained – ten years, for example. There is deliberately no default: the period is an obligation of the operator and depends on the rules that apply to them. A guessed value would erase too early or keep data for too long.
The end of retention is written into every document when it is stored and set as a lock in storage. A period changed later only applies to new documents; existing retention cannot be shortened.
Legal hold for entire chains
A legal hold keeps an entire document chain in place, for example during litigation. While it applies, nothing is erased, not even after retention has ended – and any new version produced during this time is held immediately as well. Setting and releasing require a reason and are recorded in the chain with person and time. Once released, each revision’s own retention dates apply again.
Erasure that preserves the chain
Once retention has ended, Reporting erases documents that are due on its own in regular runs. On request – for example when a data subject asks for erasure and no retention obligation stands in the way any more – a document can also be erased individually. Before retention ends, there is no way to erase it.
Erasure removes the content and destroys the document’s key. This also makes any data kept alongside it unreadable. The revision remains in the chain as a tombstone with all its fingerprints, and the chain still verifies as intact even though the document is gone.
Reasons without personal data
Reasons for holds and erasure are short, defined keys such as “litigation-hold”, not free text. Chains are never deleted – a freely worded sentence could otherwise keep personal data there permanently.
Separate responsibilities
Reading, holding and erasing are three separate permissions. Someone who reads inspection reports may not, for that reason alone, freeze them for proceedings or erase them. Platform administrators do not automatically have these rights either. Holding and erasing can additionally require a stronger or recent sign-in.
The technical implementation supports your retention and erasure concepts. Which periods and reasons apply to your documents is for you to assess.