# DAT-04 Retention policies

Domain: DAT Data Protection & Privacy · HI-AAF v1.3 · Public review · https://humanintel.net/standard/dat/dat-04

Retention policies apply to conversation logs, agent memory, derived artifacts, and traces. Data is not retained longer than the documented period absent legal hold.

Data retention periods are documented per data class, conversation logs, agent memory, derived artifacts, traces, and enforced by deterministic process. Data is not retained beyond the documented period absent a legal hold. The retention policy covers all agent-related data stores, including those managed by third-party providers.

## Maturity

- L1 Ad hoc: Controls exist informally; documentation is incomplete; no consistent review.
- L2 Documented: Controls are written down; ownership is assigned; review cadence is defined.
- L3 Operated: Controls are followed in practice; evidence is collected; deviations are tracked. Published criterion for DAT-04: Retention periods are documented per data class; enforcement is automated; retention compliance is audited at a documented cadence; data disposal at end of retention is logged.
- L4 Measured: Control effectiveness is measured against documented thresholds; trends are reported.
- L5 Continuously Improved: Controls evolve based on incident learning; maturity gains are evidenced over time.

## Evidence an assessor asks for

- Retention periods are documented per data class.
- Enforcement is automated.
- Retention compliance is audited at a documented cadence.
- Data disposal at end of retention is logged.

## Framework mappings

- NIST AI RMF: MANAGE 1.3
- ISO/IEC 42001: A.7.4, A.8.2
- OWASP LLM Top 10: LLM06
- SOC 2 (TSC): CC6.1, C1.1
- EU AI Act: Art. 10(2)
- Singapore: PDPA s.25, MAIGF Data, AI Verify Data Governance

Mappings are directional: meeting this control evidences but does not by itself satisfy the external requirement.

## Cite this control

Human Intelligence. HI-AAF v1.3, DAT-04 Retention policies. Public review edition, July 2026. https://humanintel.net/standard/dat/dat-04