Keeping every table forever is not a control — it is a storage bill with legal fog. Hong Kong teams we work with calendar retention the same way they calendar change freezes: visible, owned, and slightly boring.
Separate regulatory minimums from comfort padding
List the shortest lawful window for each data class, then note where operations added padding “just in case.” Padding is allowed when it is intentional and funded. Hidden padding becomes an accidental archive that no one can defend during database compliance checks.
Put deletion jobs on the same board as releases
If purge jobs only live in a DBA runbook, auditors discover them late. Surface job names inside your financial auditing app as scheduled controls with last-success timestamps. Missed runs become findings instead of hallway rumors.
Document exceptions as exceptions
Litigation holds and investigations need short, dated exceptions — not permanent policy rewrites. Teach stakeholders to expire the hold in writing. Our Evidence Packaging Studio practices that expiration sentence until it sounds routine.