Do GTM Records Follow the Retention Schedule?
Review whether selected GTM records follow an approved retention process, with visible exceptions and evidence of the actual action taken.
Start with the applicable approved schedule
Identify the record classes, systems and review period. Ask the responsible records or privacy owner to confirm the applicable schedule, triggering event and exceptions. This is a proposed operational evidence review, not a legal compliance certification or a universal retention timetable.
For UK GDPR personal data, the ICO explains that retention depends on the purpose and does not prescribe one fixed period for every record type. Its guidance also distinguishes offline storage from deletion. The cited guidance is under review following the Data (Use and Access) Act; confirm the applicable requirements with the responsible adviser.
Build a traceable sample of decisions
Select records using a documented rule that includes items due for review and items with recorded exceptions. Save the population definition, selection date and schedule version. Record identifiers and system locations without copying unnecessary personal data into the audit worksheet.
For each item, link the relevant trigger, calculated review date, decision owner and action evidence. Distinguish an unknown status from a confirmed exception. Where a hold or another restriction is recorded, route it to the authorized owner rather than treating its removal as an administrative cleanup task.
Verify what the system actually did
Separate a requested action, an approved action and a confirmed action. A completed ticket may refer only to a request being submitted. Ask the system owner what the confirmation covers, including relevant copies, exports or backup arrangements under the approved process.
Report unresolved cases separately from confirmed outcomes. State which systems and record classes were outside the sample. Evidence that selected records followed a schedule cannot establish that every record is compliant or that the schedule itself satisfies all applicable obligations.
Close findings without changing the rule informally
Illustrative finding: a campaign export has a completed cleanup ticket, but the evidence identifies only the shared folder and does not address a separate working copy. The reviewer records the gap and asks the system owner to clarify scope.
The authorized owner decides the next action under the approved process and supplies confirmation. The review log preserves that decision and any remaining limitation. Changes to retention periods, holds or disposal methods go through their responsible owners rather than being improvised to improve the report’s completion rate.
Sources
- Principle (e): Storage limitation, Information Commissioner’s Office. UK GDPR guidance; purpose-based retention and offline storage. Guidance marked under review by the ICO.