Retention schedules that enforce themselves

Ask most teams what their data retention policy is and you'll get a confident answer. Ask them to prove the last deletion actually ran on schedule, and the confidence usually disappears. A policy that isn't enforced by the system is a description of intent, not a control.

Define once, per category

Retention needs to be set at the data category level — transaction records, support tickets, marketing consent logs — each with its own clock, because they don't share a legal basis for how long they can be kept.

Once that clock exists, deletion or archival needs to run without a human remembering to trigger it. The audit value isn't the policy document — it's the log entry showing the deletion actually executed, on time, every cycle.