These policies go two ways. Companies need to be able to delete data eventually, but they also need to make sure that employees are not deleting data on their o

These policies go two ways. Companies need to be able to delete data eventually, but they also need to make sure that employees are not deleting data on their own in order to hide illegal activity. Having a retention policy of X months then cuts both ways. If you delete data before 18 months, well that looks awfully suspicious.