{"catalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","kind":"record","record":{"attributes":{"category":"privacy","domain":["Data Protection & Privacy","Compliance, Audit & Assurance"],"inherent_rating":"medium","taxonomy":["nist-privacy-risk","enterprise-risk"]},"canonicalUrl":"https://controlsmap.com/?v=1&node=risk%3Adata-retention-noncompliance","description":"Retaining personal data beyond necessity/mandated schedules (privacy and breach risk) or deleting records before required retention periods (litigation-hold, regulatory, tax risk); records-management policy not enforced technically.","details":{"category":"privacy","impact":"medium","inherent_rating":"medium","likelihood":"medium","risk_id":"data-retention-noncompliance","taxonomies":["nist-privacy-risk","enterprise-risk"],"treatment":"mitigate"},"id":"risk:data-retention-noncompliance","mapUrl":"https://controlsmap.com/?v=1&node=risk%3Adata-retention-noncompliance","sourceIds":["ccpa","gdpr","iso-27001","nist-800-53","soc2"],"sourceUrl":null,"title":"Unlawful retention or premature deletion of records","type":"risk"},"relationships":[{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:373c45887513ad94fe7fcd0efc5cb6d11335eccf3f88f46255d388f9c6441dfc","properties":{"rationale":"An approved retention schedule with timely, irreversible destruction directly prevents both unlawful over-retention and premature deletion.","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-data-09-f83a01a3.json","sourceId":"uc:UC-DATA-09","targetDetailPath":"/data/v1/records/risk-data-retention-noncompliance-ec7b8dbc.json","targetId":"risk:data-retention-noncompliance","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:d87f115fdbef50bd52106f58ee1b2e0ebacdc5a152c961fe436b0015ec9d2659","properties":{"rationale":"Executing erasure requests deletes specific subjects' data, reducing unlawful over-retention.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-data-08-794007b4.json","sourceId":"uc:UC-DATA-08","targetDetailPath":"/data/v1/records/risk-data-retention-noncompliance-ec7b8dbc.json","targetId":"risk:data-retention-noncompliance","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:dbb71b2b62f894967b4ebd26617f416195b90a5837b511cf41d4efee0e71a7ad","properties":{"rationale":"Retaining and disposing of records per schedules aligned to legal/regulatory/contractual requirements (ISO A.5.33) prevents unlawful retention and premature deletion.","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-audit-25-e23c8618.json","sourceId":"uc:UC-AUDIT-25","targetDetailPath":"/data/v1/records/risk-data-retention-noncompliance-ec7b8dbc.json","targetId":"risk:data-retention-noncompliance","type":"mitigates"}],"schemaVersion":1}