# Retention Impact Assessment Templates — Orion Data Vault Corp

## Retention Impact Assessment Template

```
RETENTION IMPACT ASSESSMENT
Reference: RIA-YYYY-NNNN
Date: YYYY-MM-DD
Assessor:
DPO Review:

PHASE 1: SCOPE AND CONTEXT
- Processing activity:
- Business owner:
- Purpose(s):
- Legal basis:
- Data subjects:
- Data categories:
- Special category data: Yes / No
- Estimated volume:
- Data sources:
- Recipients:
- International transfers: Yes / No

PHASE 2: REGULATORY REQUIREMENTS SCAN
| Domain | Applicable | Statute | Minimum Period | Notes |
|--------|-----------|---------|----------------|-------|
| Tax/fiscal | | | | |
| Company law | | | | |
| Employment | | | | |
| Health & safety | | | | |
| Financial services | | | | |
| AML/CTF | | | | |
| Sector-specific | | | | |
| Contractual | | | | |
| Limitation periods | | | | |

PHASE 3: PURPOSE-BASED ANALYSIS
| Purpose | Legal Basis | Duration | Retention Period | Justification |
|---------|------------|----------|-----------------|---------------|
| | | | | |

PHASE 4: PROPORTIONALITY
- Minimum necessary: [Yes/No]
- Shorter period possible: [Yes/No]
- Anonymization possible: [Yes/No]
- Staged deletion: [Yes/No]
- Access restriction plan:
- Risk level: [Low/Medium/High]
- Alternatives considered:
- Conclusion:

PHASE 5: RECOMMENDATION
| Phase | Duration | Data State |
|-------|----------|------------|
| Active | | Full data, full access |
| Passive | | Full data, restricted |
| Reduced | | Minimized, restricted |
| Anonymized | | Anonymized, unrestricted |
| Deletion | | Permanent |

Total identifiable retention: [days]
Trigger event:
Deletion method:

APPROVALS:
- Business Owner: _________________ Date: _________
- DPO: _________________ Date: _________
- Legal: _________________ Date: _________
```

## Implementation Checklist

- [ ] Added to retention schedule (DPO — 14 days)
- [ ] Automated deletion configured (IT — before processing)
- [ ] ROPA updated (DPO — 14 days)
- [ ] Privacy notice updated (DPO/Marketing — before processing)
- [ ] Access restrictions configured (IT/Security — before processing)
- [ ] Processor agreements updated (Legal — before processing)
- [ ] First review scheduled (DPO — 12 months)
- [ ] Staff briefed (DPO/Training — before processing)