Retention and residency rules
- 0 applicable rules, 0 evidence items, 0 owners.
- 0 ruled out.
AI governance, security and trust
Retention, holds and where work is processed
Records are kept too long or deleted too soon, and nobody can show why.
Demonstration: Pinecrest Foods plc (fictional) · Food manufacturing. Fictional data and a scripted answer.
The situation
- Organisation
- Pinecrest Foods plc (fictional)
- Who is asking
- Records manager
- Industry
- Food manufacturing
- What happened
- The company is moving records to a new system and must decide how long each kind may be kept and where it may be processed.
The question asked
For each kind of record we hold, how long may we keep it, can it be deleted, and where may it be processed?
What it reads, and who can see the result
- Record types registerThe kinds of record and the attributes that decide their rules.
- Retention and residency rules documentSynthetic rules by condition.
- Reads
- The record types and the rules.
- Does not read
- The records themselves.
- Permission
- Records management access.
- Who sees it
- The records manager, legal and IT.
Try it
Answer the questions about the organisation. Each rule becomes applicable, not applicable, or undetermined until the questions it depends on are answered: nothing is assumed.
| Obligation | Where | Status | Evidence and owner |
|---|---|---|---|
| Delete personal data when no longer needed (max 6 years) Synthetic Records Code, art. 5 | All regions | UndeterminedNeeds: Do the records include personal data about customers or staff; Are any of them under a legal hold or an open investigation | None needed |
| Do not delete while a hold applies Company hold policy | All regions | UndeterminedNeeds: Are any of them under a legal hold or an open investigation | None needed |
| Keep financial and tax records for seven years Synthetic Tax Code, s. 22 | All regions | UndeterminedNeeds: Do they include financial statements or tax records | None needed |
| Process northern-region personal data in the northern region Synthetic Data Code, art. 12 | North | UndeterminedNeeds: Do the records include personal data about customers or staff; Are customers or staff in the northern region | None needed |
- Applies
- 0
- Does not apply
- 0
- Undetermined
- 4
- Answered
- 0 of 4
The answer
Simulated answer. Written for this fictional case, not produced by a live model. Only the figures in it are computed, from what you decided above.
0 retention and residency rules apply, 0 do not, and 4 are undecided.
Each rule depends on facts about the records [S1][S2]. A hold changes the answer to everything else: while a hold applies, deletion rules do not run, which is why the hold question comes first.
Where a fact is unknown the rule is undetermined and says what it needs; the platform never infers that records are free to delete. The register names evidence and owner for the rules that apply.
Relies on: S1 · Record type registerS2 · Synthetic Records Code and company policy
Review and approval
The records manager decides. Approving sets the retention and residency rules the new system will be configured to apply. It does not delete any record and does not move any data.
Not ready to approve. 4 obligations are undetermined until the questions they depend on are answered. Answer them first; nothing is assumed.
In the product this is a different person with the right permission. Here you play that role to see the rule.
What it produces
Limits of this example
- Synthetic rules; a real schedule follows the organisation's legal advice.
- A rule that depends on a fact not asked here would be missed.
- This is a scripted demonstration on fictional data. No model was called and no real organisation, person or result is shown.
More in AI governance, security and trust
- A Trust and Security area for customersSecurity and procurement teams ask the same questions again and again, and the answers are scattered.
- Govern the AI your organisation usesTeams adopt AI tools faster than anyone records them, who approved them or what they may touch.
- Permissions, approvals and an audit trailWhen something goes wrong, nobody can say who could do what, who approved it and when.
- Answers that show their evidenceA fluent answer that cannot show where it came from is a risk, not a help.
The AI governance, security and trust story · This capability in the full register