Keep what you must, dispose of the rest
Data lifecycle and records management
Last reviewed
Ghani Governance designs Microsoft Purview retention and records management for UK organisations around what you must keep, for how long, and where it lives. That includes the tension between UK GDPR storage limitation and sector or contractual retention. A default label dump is not a records programme.
Data lifecycle management in Microsoft Purview uses retention policies and retention labels to keep content for as long as it is needed and delete it afterwards. Records management adds declared records, disposition review and proof of deletion for regulated content.
Retention that can be explained, records that can be defended
Microsoft Purview Data Lifecycle Management and Records Management sit together: retention labels and policies decide how long content stays; records declaration, restrictions and disposition review decide when something is a record and who may dispose of it. Switching on a default Microsoft 365 retention policy is not an implementation.
Ghani Governance designs that model for UK organisations — including the tension between UK GDPR storage limitation and sector or contractual retention — then configures Purview around it. Product behaviour is defined in Microsoft’s data lifecycle and records management documentation; our job is the design, test and handover layer those pages do not provide.
What we configure
Retention obligations
What you must keep, for how long, and where it actually lives — not a copied schedule nobody owns.
Retention labels and policies
Data lifecycle labels and publishing scoped to locations and populations that match the obligation.
Records declaration
When an item becomes a record, what that restricts, and who is allowed to declare or lock it.
Disposition review
A path for items that must be reviewed before deletion, with named reviewers rather than an unattended job.
UK GDPR in general terms
Storage limitation versus legal or regulatory retention, written so a DPO can follow the reasoning. Not a legal opinion on your facts.
Policy to Purview design · Unified Catalog · eDiscovery · sensitivity labels · Compliance Manager · All Purview services
Process
Discover
Existing labels, holds, and the retention rules people already follow by habit.
Design
A short label set tied to obligations, plus when something is a record.
Configure
Lifecycle and records settings in Purview for a pilot scope.
Pilot disposition
Reviewers see real items before automatic deletion is trusted.
Hand over
Owners, change control, and how a new obligation becomes a label change.
Lifecycle and records questions
Is this the same as backup?
No. Backup is a restore capability. Data lifecycle and records management decide how long information should remain available for business, legal or regulatory reasons, and when it should be disposed of. They solve different problems.
Do you implement records management separately from retention?
Not as two thin pages. Retention labels and policies (data lifecycle) and records declaration, restrictions and disposition review (records management) are designed together so a record is not just a renamed retention label.
Will this delete things we still need?
Not if it is designed against actual obligations. We start from what you must keep and what you may dispose of, then configure labels and disposition review. Automatic deletion without a reviewed model is how programmes lose trust.
Related Purview services
Other Ghani Governance Microsoft Purview services on this hub that often sit alongside data lifecycle and records management:
- Policy to Purview design — mapping written retention obligations before labels and disposition go live
- Unified Catalog and data governance — ownership and glossary that retention alone cannot invent
- Microsoft Purview eDiscovery — holds and collections that must coexist with retention and disposition
- Sensitivity labels and information protection — classification alongside retention labels
- Compliance Manager — assessment programmes that may surface retention-related improvement actions
- All Microsoft Purview services — full hub list
Data retention policy design
A data retention policy sets how long each type of information is kept and why. In Purview, a retention policy applies broadly to locations; retention labels apply to specific items. Good data retention balances legal holds, UK GDPR storage limitation and business need. Records management is the stricter layer for content that must be immutable.
Records management and retention questions
What does records management do?
It makes sure important records are kept for the right period, protected from change, and disposed of with evidence when their time is up. In Purview this means retention labels, declared records and disposition review.
What is a retention policy?
A retention policy keeps, deletes, or keeps then deletes content after a set period. Purview retention policies apply to whole locations such as mailboxes, sites and Teams chats. Retention labels apply to individual items.
How long should records be kept?
There is no single number. Periods come from law, regulators and contracts (for example, HMRC expects company accounting records to be kept for six years), so we take them from your retention schedule rather than a template.
What happens to emails after a retention policy?
Users can still delete items. Purview keeps a copy in a hidden preservation location until the retention period ends, then deletes it if the policy says so. Items stay discoverable through eDiscovery until then.
Book a discovery workshop
A scoping conversation about what you need to protect, what is already configured, and what must not break.