Compliance Draft

Data Retention Policy

Draft template for local review. Actual retention periods must be confirmed with legal or compliance advisors before launch.

Application records

Application records should be kept only as long as needed for service delivery, dispute handling, legal compliance and audit purposes.

Passport images and PDFs require the shortest practical retention period and stricter access controls.

The admin system should support archive or deletion workflows with audit logs and role-based approval.

Database and private file backups must follow the same retention and access rules as production data.