Standard 5 per Section 23 + the Schedule of the Jamaica Data Protection Act 2020: Personal data shall be kept for no longer than is necessary for the purposes for which they are processed. The fifth Data Protection Standard requires Storage Limitation - retention only as long as necessary + then erasure or anonymisation. (1) Retention Period Setting: (a) by purpose - different purposes may have different retention; (b) by lawful basis - consent withdrawal triggers earlier deletion; (c) by data category - sensitive data requires shorter retention; (d) by legal requirement - statutory minimums (tax: 7 years; banking: 5-7 years; employment: 5-7 years post-departure; medical: lifetime + 25 years; certain children's records: 25 years; AML/KYC: 7 years post-relationship); (e) by jurisdiction - if data subject in multiple countries take strictest. (2) Retention Schedule per Section 25 ROPA: (a) documented per processing activity; (b) per data category within processing; (c) clear trigger for retention period (creation + last update + relationship end + statutory mark); (d) end-of-life action defined (deletion + anonymisation + archive). (3) Erasure Methods: (a) Logical Deletion - flag for deletion in active systems; (b) Physical Deletion - cryptographic erasure + secure wipe + media destruction; (c) Anonymisation - irreversible + meets re-identification risk threshold; (d) Pseudonymisation - reversible + still personal data under Jamaica DPA; (e) Statistical disclosure control for aggregates. (4) Backup Retention: (a) backups must follow retention schedule; (b) immutable backups + retention complication; (c) crypto-shredding for cloud backups; (d) recovery from backup must respect erasure; (e) DR/BC plans must account for privacy. (5) Archival + Research per Section 41: (a) Section 41 exception for archiving in public interest + historical + scientific research + statistical purposes; (b) appropriate safeguards including pseudonymisation + access restriction + aggregation; (c) data minimisation strictly applied to archive copies. (6) Legal Hold + Litigation Hold: (a) statutory + regulatory + court-ordered holds override retention deletion; (b) hold documentation + audit trail; (c) hold release triggers normal retention review; (d) Section 39 erasure right does NOT override valid legal hold. (7) Sector-Specific Retention: (a) Banking + Insurance per FSC + BoJ requirements + AML/KYC 7 years; (b) Health per Public Health Act + medical records typical 25 years + lifetime; (c) Employment per Labour Relations and Industrial Disputes Act + 5-7 years post-departure; (d) Tax per Tax Administration Act + 6-7 years; (e) Real Estate per Registration of Titles Act + permanent. (8) Implementation Tools: (a) Data Lifecycle Management (DLM); (b) Information Lifecycle Management (ILM); (c) Records Management per ISO 15489; (d) Retention orchestration systems; (e) WORM Write-Once-Read-Many for compliance archives; (f) Backup ageing + tier-down + deletion; (g) Cloud Object Lifecycle policies (AWS S3 Lifecycle + Azure Blob Lifecycle + Google Cloud OL). (9) Periodic Review: (a) Annual retention audit; (b) Data Subject Right of Erasure interplay; (c) Purpose review trigger (Standard 2) often triggers retention review; (d) Data Map currency. (10) Penalties for Over-Retention: (a) Section 50 administrative penalties; (b) civil claim if retention causes harm; (c) increased breach impact + larger compensation. Coordinates with EU GDPR Article 5(1)(e) + Article 17 + UK DPA 2018 + Convention 108+ Article 5(4)(e) + ISO 15489 + ISO/IEC 27701 + DAMA DMBOK + Jamaica Section 25 ROPA + Section 39 Erasure + Section 41 Archival + Jamaica FSC + BoJ + Public Health Act + Tax Administration Act + Labour Relations Act + Registration of Titles Act. Jamaica DPA 2020 Standard 5 + Section 23 applies.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.