Data retention

Almost nobody decides to keep data forever. They simply never decide to delete it.

The default in most systems is to keep everything, so retention happens by omission, and a breach ten years from now exposes records from today that had no business still existing. Deletion is also genuinely hard: copies in backups, exports in spreadsheets, an old test database nobody remembers. That is exactly why it needs deciding in advance rather than when somebody finally asks how far back the data goes.