Harbor Data / 06 / PRACTICE GUIDE

Retention schedules, legal holds and backups

Separate retention time from deletion authority. Review trigger events, copies and holds using fixed-time synthetic records.

Download guide and workpapers

Original AI-assisted SecNet educational content; examples are fictional. Not a source organization publication or endorsement. Sources checked: 2026-10-21.

Local data passport desk

Use synthetic metadata only. Input is neither transmitted nor saved to an account. Include no actual file content, secrets or personal data.

Synthetic data-dossier JSON

{
  "version": 1,
  "caseId": "harbor-data",
  "asOf": "2026-10-21T09:00:00Z",
  "records": [
    {
      "id": "public-notice",
      "owner": "Fictional data owner",
      "classification": "public",
      "purposeRef": "purpose-01",
      "destination": "public",
      "recipientApproved": false,
      "encrypted": false,
      "reviewRef": "review-01",
      "retainUntil": "2026-12-01T00:00:00Z",
      "legalHold": false
    },
    {
      "id": "internal-plan",
      "owner": "Fictional data owner",
      "classification": "internal",
      "purposeRef": "purpose-02",
      "destination": "partner",
      "recipientApproved": true,
      "encrypted": true,
      "reviewRef": "review-02",
      "retainUntil": "2026-12-01T00:00:00Z",
      "legalHold": false
    },
    {
      "id": "partner-contract",
      "owner": "Fictional data owner",
      "classification": "confidential",
      "purposeRef": "purpose-03",
      "destination": "partner",
      "recipientApproved": true,
      "encrypted": true,
      "reviewRef": "review-03",
      "retainUntil": "2026-10-01T00:00:00Z",
      "legalHold": false
    },
    {
      "id": "case-evidence",
      "owner": "Fictional data owner",
      "classification": "restricted",
      "purposeRef": "purpose-04",
      "destination": "public",
      "recipientApproved": false,
      "encrypted": false,
      "reviewRef": "review-04",
      "retainUntil": "2026-10-01T00:00:00Z",
      "legalHold": true
    },
    {
      "id": "working-copy",
      "owner": "Fictional data owner",
      "classification": "confidential",
      "purposeRef": "",
      "destination": "internal",
      "recipientApproved": true,
      "encrypted": true,
      "reviewRef": "",
      "retainUntil": "2026-10-01T00:00:00Z",
      "legalHold": false
    }
  ]
}

Classes, encryption and references are assertions; content is not scanned and actual approval is not verified. A fixed UTC time is used. Hold and retention outcomes are independent of sharing. The tool performs no DLP enforcement, legal decision, anonymization or deletion.

EVIDENCE REVIEW DESK

Move from observations to decisions.

Code here is a local policy model with no target connection. Passing model cases are not security approval or device tests.

A day count exists / Incomplete decision

Inspect an incomplete decision based on record existence or another positive signal. Consider denial cases alongside permitted use.

s => s.daysListed === true

A day count explains neither purpose, basis nor trigger event. A schedule without ownership and an anchor is incomplete for actual retention decisions.

Choices and outputs last only on this open page; they do not update account progress, career status, points or certificates.

01 / EXPLANATION

What starts the retention period?

Harbor’s schedule records category, purpose, obligation assessment, trigger event and owner. Creation, contract end or another event may start a period; a day count alone is insufficient. Authorized legal, records and business owners determine actual requirements in context. This package calculates no universal KVKK/GDPR period and presents no example date as a legal obligation. Its retainUntil value is only a fictional review threshold. Confusing source-event dates with derivative-file dates can produce unintended retention. Keep the rationale and clock anchor beside the date, not in an unrelated spreadsheet.

02 / EXPLANATION

Holds and authorized decisions

A record may be needed for an investigation or legal preservation. Authorized teams define scope, authority and release procedures. In the local profile, legalHold true yields hold even after the date; this is a teaching rule only. The tool verifies no actual legal restriction or its validity. Compare two fictional records with the same date but different hold states. Expired means review is needed, not execute deletion. The tool deletes no files, backups or records and makes no determination about which legal duties take precedence in a real matter.

03 / EXPLANATION

Backups, archives and copies differ

Backups may support recovery while archives support records retention, with different behavior even inside one product. Primary deletion may not immediately remove snapshots, replicas or SaaS preservation copies. Record copy scope, access, timing and handling of older data after restoration. Microsoft Purview retention behavior is one product example, not universal storage semantics. Harbor asks who will validate each copy. This exercise changes no real retention or recovery policy and promises no instant removal from every system. A restore plan should account for prior authorized disposition decisions rather than silently reintroducing old records.

04 / EXPLANATION

Thresholds, evidence and review

The local desk compares asOf and retainUntil using valid UTC calendar times; equality means review is due. It never uses the computer’s current clock, keeping examples reproducible. Hold, review-due and not-due are independent from sharing decisions. A shareable document may need retention review, while a blocked share may still need preservation. An owner evaluates ongoing purpose, scope and exceptions. Actual disposition needs separate authority and validation; the local output is neither a compliance report nor a deletion instruction. It highlights questions rather than resolving real legal obligations.

Build the evidence yourself.

Blank workpapers are not completed tests. Fill them in your authorized environment without secrets or real personal data.

Data passport and copy scopeMarkdown · EN Sharing and retention review planMarkdown · EN Observation, copy and evidence gapMarkdown · EN Authorized decision and outcome verificationMarkdown · EN

Full guide with code, outputs and reasoning ↓

Primary references

Explanations are authored by SecNet. References support method and platform context; verify current editions and organizational policy for real use.