ARMA Mile High Denver: Best Practices IG Can Prevent a Catastrophic Data Breach: The Case of Allium

A data breach at Allium UPI, compromised the personal information of nearly half of Estonia’s population.  This type of catastrophic breach underscores the vital importance of data deletion based on a clear retention schedule. Privacy regulations, such as the GDPR, mandate that personal data be kept only as long as it serves a specific business or legal purpose, which includes complying with a retention schedule based on EU law. Simply put, when personal data is both no longer necessary and not required to be kept based on a legal retention requirement, it should be deleted promptly to reduce the risk of exposure.