Browse retention and deletion rules

Browse Retention and Deletion Rules

The Retentions & Deletions list is your organisation's central register of every data retention period and deletion rule defined in DPMS. It gives compliance officers, DPOs, privacy managers, and risk managers a single, searchable place to see exactly how long each category of personal data is kept — and when it must be erased. Without this register, retention obligations scatter across emails and spreadsheets; with it, you have the evidence base you need for audits, supervisory authority inquiries, and internal reviews. Every rule you create here also powers the retention dropdowns throughout DPMS, so this screen is the foundation for your ROPA entries, asset records, assessments, and tasks.

How to open it

In the main left-hand sidebar, navigate to Retentions & Deletions. The index page loads immediately — there is no sub-tab to click. You need read access to the Retentions & Deletions module to see the screen at all. If your account only has access to records where you are listed as a responsible person, you will still reach the same screen but will see a filtered list rather than the full register.

What you see

The page opens with a toolbar running across the top. On the left side of that toolbar sits a search box, and next to it are filter and sort controls that let you narrow the list by fields such as country or period type. On the right side of the toolbar are the primary action buttons: a Create button that expands into a menu of creation options, plus export controls.

Below the toolbar, the main area is a table where each row is a single retention or deletion rule. The table shows five columns: the rule's name, its duration, whether it is a retention or deletion period, the country it applies to, and its legal reference. If a rule has a legal source URL attached, a small external link icon appears in the legal reference column — clicking it opens the source document in a new tab. If a rule has a pending change request waiting for review, a flag indicator appears on that row.

The list loads more records automatically as you scroll down, so there is no page-by-page navigation to manage.

Working with this screen

Checking whether a rule already exists before creating a new one

Before adding a new rule, search for it to avoid duplicates. Click inside the search box at the top left and type a keyword — for example, "employee records." DPMS searches the backend in real time as you type, so results update within a moment of each keystroke. If a matching rule appears in the table, click its row to open the detail view and review whether it covers your needs. If the table shows no results, you are clear to create a new one.

Users whose accounts are scoped to assigned records only will see a filtered subset of results, even when searching. If a colleague reports not finding a rule you can see, check their permission level first.

Creating your first retention rules

When the table is empty and you need to build your organisation's retention register from scratch, click the Create button in the top-right corner of the toolbar. The button expands into a short menu with up to four options:

• Create manually — opens a form where you fill in the rule name, choose Retention or Deletion as the period type, set the duration (a specific number of days, weeks, months, or years — or a qualitative value such as Indefinite), add a legal reference text and optionally a URL to the source document, and assign responsible persons. Once you save, DPMS stores the rule and takes you to its detail view. Use the back arrow to return to the index, where the new row now appears.
• Create from database — visible only when your IT team has connected the Filerskeeper integration in IT Settings. This option takes you to a guided flow where you pick a country, then a category (for example, Human Resources), then a subcategory. A table of pre-researched obligations appears, sourced from the Filerskeeper legal database. Select the rows you want by checking their checkboxes, then click Save. DPMS creates multiple rules at once and you return to the index to see them all.
• Create from company — imports a shared rule from your organisation's shared library. This option appears only when the sharing feature is enabled in IT Settings.
• Import — lets you upload a .json file of rules exported from another DPMS instance. The file must follow the DPMS export format (see the JSON export option described below). This option requires the import permission; selecting a file without that permission has no effect.

Heads up: If you do not see the Create from database option, the Filerskeeper integration has not been enabled. Contact your DPMS administrator to check whether an API key has been entered in IT Settings.

Filtering the list for an audit or review

When you need to focus on a subset of rules — for example, all rules tagged with a specific country, or all rules of a particular period type — use the filter controls in the toolbar. Click the filter area to open the available options, select your criteria (such as Country = Germany), and the table updates immediately to show only matching rows. You can combine multiple filters at once.

To sort the table by a particular column, click the sort control for that column. Ascending and descending order both work for most columns; the Legal Reference column does not support sorting.

Filters you apply stay in place if you navigate away and return during the same session, so you do not lose your view when clicking into a detail record and coming back.

Exporting the retention register for a report or audit

To produce an offline copy of your retention rules, locate the export options in the toolbar. You can download the current list — including any active filters — as either a JSON file or an Excel spreadsheet (.xlsx).

A JSON export is useful if you plan to import the rules into another DPMS environment later. An Excel export is the better choice for attaching to an audit report or sharing with stakeholders who do not have DPMS access. The export respects whatever filters you have applied, so apply your filters first, then export, to get a focused dataset rather than the full register.

Tip: If you are exporting for an audit, apply your filters before clicking the export button. The download will include only the rules currently visible in the table, which is usually what the auditor needs.

Reviewing a rule and checking for pending change requests

Click any row in the table to open that rule's detail view. There you will find all of the rule's information organised across tabs: the general fields, linked assets, linked tasks, linked assessments, workflows, and access management.

If a row displays a flag indicator, it means a colleague has submitted a change request for that rule and it is waiting for review. When you open the detail view, go to the Workflow or Required Action tab to see the outstanding request before making any edits. Editing a rule with a pending change request may be restricted until the request is resolved.

Field reference

These are the columns you will see in the table and what each one means:

• Period Name — The human-readable name you gave the rule when creating it, shown in your active language where a translation exists. This field is required when creating a rule, so an empty value is unusual.
• Duration — The length of the retention or deletion period. This can be a number combined with a time unit (for example, "3 Years" or "18 Months"), or a qualitative label such as "Unspecified," "Indefinite," or "Permanent." These qualitative values are valid entries — not missing data — and are appropriate when a regulation does not prescribe a fixed time span. An empty value means neither was set at creation.
• Period Type — Whether the rule describes a Retention period (data must be kept for at least this long) or a Deletion period (data must be erased at or by this point). An empty value means the type was not specified when the rule was created.
• Country — The jurisdiction the rule applies to, particularly relevant for rules imported via Filerskeeper. Rules created manually without a country assignment will show nothing here.
• Legal Reference — The citation to the law, regulation, or internal policy that mandates this rule (for example, "GDPR Art. 17"). Text longer than 100 characters is truncated with an ellipsis. If a source URL was also saved on the rule, a small link icon appears here; clicking it opens the original legal document in a new browser tab. Note that the display text and the URL are two separate fields — a rule can have one without the other.

How this connects to the rest of DPMS

The Retentions & Deletions module sits at the centre of your compliance data model. Here is how it connects to other parts of DPMS:

• ROPA (Records of Processing Activities): Whenever a processing activity record asks how long data is retained, the dropdown that appears is populated from the rules defined here. If no rules exist, that dropdown will be empty across all ROPA entries and throughout the system.
• Assets: Each retention rule can be linked to specific data assets (databases, file shares, systems) from the Assets tab inside the rule's detail view. This documents which physical or logical data stores are subject to the rule.
• Assessments (DPIAs, LIAs): Assessments can reference retention rules via the Assessments tab on each rule's detail view. This provides auditable evidence that a processing activity's retention period was formally assessed.
• Tasks: Compliance tasks — such as "Review the marketing email retention period by Q4" — can be linked to individual rules, creating a traceable record of who is responsible for keeping each rule current.
• Workflows: Each rule can have a periodic review workflow triggered against it, ensuring rules are revisited on schedule.

After finishing your work on this screen, you will typically move to the ROPA module to link your new rules to processing activities, or to the Assets module to document which data stores each rule governs.

Tips & common pitfalls

Heads up: If the Create from database option does not appear in the Create menu, the Filerskeeper integration has not been enabled for your organisation. Ask your DPMS administrator to set it up in IT Settings.

Tip: Always search before creating. A quick search for the rule name can save time and prevent duplicate entries that will confuse your ROPA dropdowns later.

• Scoped users see fewer records. If your account has access only to records where you are a responsible person, the list and all search results will be filtered to those records. This is expected behaviour, not a bug — but it means your view may differ from a colleague with full read access.
• Only .json files work for import. The import feature accepts only files produced by DPMS's own JSON export. Importing an external spreadsheet or a JSON file from a different source will either fail silently or produce a validation error.
• "Unspecified" and "Indefinite" are intentional entries. When the Duration column shows one of these labels, it is not a gap in your data. These are valid qualitative values used when a regulation does not set a fixed period. They are just as legally meaningful as "7 Years."
• Pending change requests may block editing. If you see a flag on a row and need to edit that rule, open the detail view and resolve the outstanding change request from the Workflow or Required Action tab before attempting edits. The edit button may be disabled until this is done.
• The link icon in the Legal Reference column requires both fields to be filled. The display text (for example, "GDPR Art. 17") and the URL to the source document are stored separately. If you create a rule with only one of them, you will get text but no clickable icon, or an icon with no label. Fill in both fields for the best result.
• The row action icons on the right side of each row (the small icons for ban, envelope, memo, and print) are not yet active. They are visible but clicking them does nothing in the current version. They are placeholders for future features.