Although the PPL does not impose a single retention period, the use-limitation principle (s.2 and s.8(b)) requires that information be kept only as long as necessary for the registered purpose. The Data Security Regulations require secure disposal of media and data when no longer needed. Retention schedules should be defined per database and aligned to the definition document.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.