Docs / Data Retention

Data Retention

Understanding data retention is important for compliance. This guide explains how SAR Portal manages data throughout its lifecycle.

30 days after a case closes, its documents and the requester’s contact details are removed automatically, unless the case is on legal hold. You choose how long the case record itself is kept before it is deleted.

Retention Overview

Data Type Active Period After Closure Retention Period
Case Data While open Requester’s contact details removed 30 days after closure (unless on legal hold) Closed case record deleted after the retention period you choose, counted from the date the case was created (default 12 months). Open cases and cases on legal hold are never deleted automatically
Documents While the case is open Kept for 30 days after closure, then deleted when the case is anonymised (unless on legal hold) None after that
Audit Logs Always Kept; the requester’s details are removed when the case is anonymised 7 years, or indefinitely while the case is on legal hold
User Data While active On request Until deletion

Case Data Retention

Active Cases

While a case is open:

Closed Cases

When a case is closed:

Anonymization

30 days after closure (unless the case is on legal hold):

Imported past cases are anonymised 30 days after they were imported.

An Admin can also anonymise a closed case at any time before the 30 days are up: on the case page, click Manual Anonymization in the Case Closure Information panel. This is recorded in the audit log as ManualCaseAnonymization. See Case Actions.

Why Hash the Email?

The email hash allows:

A hash is pseudonymised data, so it is still personal data under GDPR. Anyone who knows the email address can match it, which is how the verification works.

Document Retention

During Active Cases

Document Deletion

When documents are deleted:

Soft Delete (Immediate)

Permanent Delete (30 Days After Case Closure)

After Case Closure

30 days after a case closes, all its documents are permanently deleted (unless the case is on legal hold):

Download anything you must keep before then.

This aligns with data minimization principles - don’t keep data longer than necessary.

Audit Log Retention

Standard Retention: 7 Years

Based on:

What’s Retained

Audit logs keep your staff’s names and emails. When a user’s account is erased through account deletion, their email in the audit entries becomes [Redacted].

While a case is on legal hold, its audit entries are kept indefinitely. When the hold is released, they return to normal expiry.

What’s NOT Retained

User Data Retention

Active Users

Full account data retained:

Removing a User

There is no deactivate option. An Admin clicks Delete next to the user on the Users page. This removes the user’s sign-in from Microsoft Entra ID and marks the user record as deleted. Their audit entries are not changed. See User Management.

User Deletion (Erasure)

When a user deletes their own account through account deletion:

Tenant/Organization Retention

Active Organizations

All data retained:

Organization Deletion

When the last admin deletes the organization, everything runs immediately and synchronously - there is no deferred purge window.

If any case is on legal hold, nothing is deleted and the admin sees: “A case in your organisation is on legal hold, so your organisation’s data cannot be deleted. Nothing has been deleted. Release the legal hold first, or contact support.”

  1. Immediate (at deletion)

    • Stripe subscription cancelled
    • All cases deleted (not anonymized)
    • All documents and blobs deleted from storage
    • All user accounts removed
    • The tenant record removed

  2. Retained afterwards

    • Anonymized audit logs (7 years, GDPR Article 17(3)(e))
    • Billing records (legal requirement)
Deletion vs cancellation
Deletion from the live service is immediate and cannot be undone. The 90-day read-only + export window applies only when you cancel a subscription (see Plans & Pricing) - it is not part of deletion.

Configuring Retention

Case Anonymization Timing

Closed cases are anonymised 30 days after closure. You cannot change this period in Settings. An Admin can anonymise a closed case sooner with Manual Anonymization.

Case Retention Period

You choose how long a case record is kept, counted from the date the case was created, before it is deleted (1 to 120 months, default 12). Set it in Settings > Case Management: in the Global Case Retention Period card, enter the Retention Period (Months). You can override it for a single case. Only closed cases are deleted; an open case is never deleted automatically, and cases on legal hold are excluded. See Case Management settings.

For cases under legal hold:

See Legal Hold.

Data Minimization

SAR Portal follows data minimization principles:

Collect Only What’s Needed

Store Only While Needed

Delete When No Longer Needed

Compliance Evidence

For each case you can export a PDF with its status history and key audit entries (status and date changes, extensions, legal holds, closure). The Audit Logs page exports entries as CSV.

Your Responsibilities

As the data controller, you should:

  1. Inform Data Subjects

    • Include retention periods in privacy notice
    • Explain anonymization vs deletion
    • Describe audit log retention

  2. Configure Appropriately

    • Set retention periods matching your policy
    • Enable legal holds when needed
    • Review settings periodically

  3. Honor Deletion Requests

    • Process account deletions promptly
    • Understand what can/cannot be deleted
    • Explain retained audit logs

Audit log retention is based on:

This is documented in our DPA and privacy notice.