Your data retention policy is part of the buyer's own compliance, which is why their privacy team reads it closely. The ICO's storage limitation guidance says "You must not keep personal data for longer than you need it," and that you need "a policy setting standard retention periods wherever possible, to comply with documentation requirements" (ICO: storage limitation).

Their questions split in two. One is how long your product keeps their data while they're a customer. The other is what happens to it when they ask for it to be deleted, or when the contract ends.

While they're a customer

In many SaaS products the honest answer to the first half is "as long as you keep it," because the customer controls their own records. But some data your product creates isn't under the customer's direct control: logs, analytics, backups, and copies held by subprocessors. Those have their own retention periods, and they're what a reviewer is really asking about.

Find your company's written retention schedule if it has one. Retention can also be something customers configure, such as a setting to delete call recordings after a chosen period. If your product has a setting like that, it's often the most useful thing to mention, because it lets the buyer apply their own policy instead of relying on yours.

What happens when retention periods differ by data type? A sales platform might hold recordings, transcripts and CRM sync data under different rules. Say that clearly, and don't summarise it as a single number.

The ICO's storage limitation guidance also says organisations should periodically review the data they hold, and erase or anonymise it when it's no longer needed. Anonymisation is worth knowing about, because some products keep aggregated, anonymised usage data after deleting the underlying records. If yours does, describe it accurately: anonymised data that can't be linked back to an individual is treated differently from personal data, but the buyer will want to see how your company makes that judgement.

Subprocessors have retention periods too. An AI provider your product calls, or the email service that sends notifications, may keep its own copy for a time under its own policy. A buyer who reads your subprocessor list will ask, and you may only be able to point to each provider's terms rather than give a single figure.

When they ask you to delete it

Deletion requests come from two directions. A buyer's end users have the right to erasure under UK and EU GDPR in certain circumstances, and the ICO notes that organisations have one month to respond to a request (ICO: right to erasure). As the buyer's processor, your product needs a way to help them meet that, whether that's a delete button for admins or a support request.

The other direction is the end of the contract. Under Article 28(3)(g) of the GDPR, a processor must delete or return personal data at the controller's choice when the service ends, unless EU or member state law requires it to be kept, and those terms sit in the DPA the buyer sends over. Expect two follow-ups: how long after termination the deletion happens, and whether they can export everything first.

Don't promise "we delete everything immediately." Backups make that hard to deliver; the backup question below covers what to say instead.

VoiceVocab's Cloud & security course includes data handling among its topics, with spoken buyer questions and written feedback, so you can practise explaining retention without overpromising. You can try the format first in the free APIs & integrations lesson, with no card needed.

The backup question

Backups are the part of a retention answer that's easiest to get wrong, and the ICO addresses them directly. Its guidance on erasure says that if a valid request is received and no exemption applies, organisations must take steps to ensure erasure from backup systems as well as live systems. It accepts that data may remain in a backup until it's overwritten, provided the backup data is put "beyond use": not used for any other purpose, and simply held until it's replaced in line with an established schedule. If your company's backups work that way, that's the accurate answer to "is it gone from backups?", along with how long the backup cycle runs.