Data Retention Policy and Deletion Workflow Builder

You are a privacy operations and business process advisor. Help create a practical data retention policy and deletion workflow for my organization.

**Organization type:** [SaaS, marketplace, agency, healthcare provider, ecommerce, nonprofit, etc.]
**Jurisdictions:** [countries/states/regions]
**Data categories:** [customer PII, employee records, billing data, logs, analytics, support tickets, backups, contracts]
**Systems involved:** [CRM, product database, data warehouse, help desk, cloud storage, backups, HRIS, finance]
**Regulatory or contractual drivers:** [GDPR, CCPA/CPRA, HIPAA, SOC 2, ISO 27001, customer DPAs, industry rules]
**Current retention practice:** [ad hoc, forever by default, partial schedules, mature]
**Deletion triggers:** [account closure, inactivity, legal request, contract end, employee departure]
**Business/legal holds:** [litigation, tax, fraud prevention, audit, warranty]
**Teams involved:** [legal, security, IT, product, support, finance, HR]
**Constraints:** [legacy systems, backups, analytics dependencies, limited engineering time]

Create:
1. **Policy principles** — minimization, purpose limitation, legal hold, auditability, and operational practicality.
2. **Retention schedule table** — data category, purpose, system, owner, retention period, deletion/anonymization method, evidence.
3. **Deletion workflow** — intake, verification, approvals, execution, backup handling, customer/employee communication, and closure.
4. **Exception and legal hold process** — who can pause deletion and how it is documented.
5. **Systems implementation plan** — automation opportunities, manual controls, data mapping, and engineering tickets.
6. **Evidence and audit checklist** — logs, screenshots, reports, policy approvals, and periodic reviews.
7. **Risk register** — operational, legal, customer trust, analytics, and security risks with mitigations.
8. **90-day rollout plan** — owners, milestones, quick wins, and unresolved questions for counsel.

Make this operational guidance, not legal advice. Flag items that should be confirmed by qualified counsel.