Data retention implementation
A retention hold needs authority, scope and a release path
Exceptions can preserve necessary records, but an unowned hold can quietly suspend deletion forever. Treat creation and removal as controlled decisions.
In this article
Define who may apply an exception
Identify the responsible legal, privacy, records or business role for each hold type. Engineers should not create a universal exception merely because a support ticket requests that data be kept.
Record the scope, reason, decision reference and review condition without exposing sensitive case details to every operator. A broad free-text flag is difficult to evaluate consistently.
Separate the authority to view held data from the authority to preserve it. A hold does not automatically grant everyone involved access to its contents.
Apply the hold to the intended copies
Map the exception across primary and derived destinations under the approved policy. A database flag may not prevent an object-storage lifecycle rule from expiring an attachment.
Conversely, a locked object may remain after the application's ordinary retention action completes. Keep that state visible so reports do not claim the entire record was removed.
Review the selected storage service's protection semantics. Governance and compliance modes or equivalent controls can have materially different bypass and removal behaviour.
Protect retention administration
Restrict who can change policy, disable workers or mark destinations complete. These actions can alter the organisation's data lifecycle even without reading the underlying records.
Use audit evidence for policy and hold changes, with actor and time. Avoid retaining full deleted content in that evidence unless an approved purpose requires it.
Test cross-organisation boundaries in multi-tenant systems. One customer's hold or deletion request must not affect another customer's similarly identified records.
Revisit and release deliberately
Give each exception a review process and owner. When released, reconsider the record under the current approved retention rule rather than assuming the original deletion job will automatically discover it.
Test a hold added between candidate selection and execution. The workflow needs a defined way to resolve that race before destructive action.
A successful review explains which authority created the exception, what it protects and how normal lifecycle handling resumes. An unexplained boolean called keepForever provides none of those answers.
Primary sources
AWS: Object LockReferences checked 11 September 2026.