Define the policy
Identify sensitive data, covered users, approved recipients, and permitted sharing or attachment scenarios.
PRIVACY & DATA HOSTING
DLP & retention
Configure sensitive-data controls and choose a retention period that fits your organization.
DLP after configuration
Data Loss Prevention (DLP) is offered after configuration. The service order defines the data to protect, inspection scope, supported detection rules, authorized handling actions, and review responsibilities before enforcement is enabled.
Configure & test
Agree the available rules and actions for your deployment, test representative messages, and review false positives before activation.
Review & maintain
Assign administrators to investigate policy events, manage approved exceptions, and review changes. Available controls depend on the configured service and licensed components.
Retention options
Choose 1, 2, 3, 4, or 5 years of data retention. Activation, covered data categories, timing, capacity, and price are specified in the service order.
These are service options. SDAIA’s guidance links retention to the collection purpose and applicable requirements. Select the period justified for each data category. See SDAIA retention guidance.
Your retention schedule
- Covered data: specify mail, attachments, archives, files, logs, and backups separately; coverage follows the agreed service.
- Start point: record whether the period starts at message receipt, archive ingestion, creation, or another defined event.
- Access & export: agree authorized access, search and export scope, and the steps for service closure.
- Separate terms: retention length, subscription term, storage quota, backup frequency, and recovery targets are defined separately.
Deletion & legal holds
The schedule must address destruction when data is no longer needed and the PDPL’s exceptions for required retention, including relevant legal proceedings. A selected period does not remove applicable individual rights or legal duties. See PDPL Article 18.
Archives and backups remain personal data. The agreed procedure must address all copies, applicable holds, deletion or anonymization, and recorded completion. Read SDAIA’s destruction guidance.
Updated 19 October 2026