Privacy policy lacks specific data retention periods
If this finding appears in a report, the sampled privacy notice did not expose a recognised explicit retention period. Review the whole notice and any linked policy: a numeric-period check may miss the criteria used to determine how long information is kept.
Why this matters
People need meaningful information about retention. UK ICO guidance includes retention periods or the criteria used to determine them. An absent detected number alone is not a compliance verdict, and no single retention duration suits every data category or jurisdiction.
How to fix it
Have the privacy owner map the actual data categories, purposes and applicable obligations. Document justified periods or appropriate determination criteria and keep the public notice consistent with real deletion or review practices. Verify the notice and implementation together. Do not copy generic seven-year or twenty-four-month periods into the policy without a reason that applies to that data.
Turn website findings into an action plan
Create an account to start a Full Audit of your website, with supporting evidence and a prioritised action plan.
Start Full Audit