Keep what you must, dispose of the rest
Data lifecycle and records management
Last reviewed
Ghani Governance designs Microsoft Purview retention and records management for UK organisations around what you must keep, for how long, and where it lives. That includes the tension between UK GDPR storage limitation and sector or contractual retention. A default label dump is not a records programme.
Retention that can be explained, records that can be defended
Microsoft Purview Data Lifecycle Management and Records Management sit together: retention labels and policies decide how long content stays; records declaration, restrictions and disposition review decide when something is a record and who may dispose of it. Switching on a default Microsoft 365 retention policy is not an implementation.
Ghani Governance designs that model for UK organisations — including the tension between UK GDPR storage limitation and sector or contractual retention — then configures Purview around it. Product behaviour is defined in Microsoft’s data lifecycle and records management documentation; our job is the design, test and handover layer those pages do not provide.
What we configure
Retention obligations
What you must keep, for how long, and where it actually lives — not a copied schedule nobody owns.
Retention labels and policies
Data lifecycle labels and publishing scoped to locations and populations that match the obligation.
Records declaration
When an item becomes a record, what that restricts, and who is allowed to declare or lock it.
Disposition review
A path for items that must be reviewed before deletion, with named reviewers rather than an unattended job.
UK GDPR in general terms
Storage limitation versus legal or regulatory retention, written so a DPO can follow the reasoning. Not a legal opinion on your facts.
Policy to Purview design · Unified Catalog · eDiscovery · sensitivity labels · Compliance Manager · All Purview services
Process
Discover
Existing labels, holds, and the retention rules people already follow by habit.
Design
A short label set tied to obligations, plus when something is a record.
Configure
Lifecycle and records settings in Purview for a pilot scope.
Pilot disposition
Reviewers see real items before automatic deletion is trusted.
Hand over
Owners, change control, and how a new obligation becomes a label change.
Lifecycle and records questions
Is this the same as backup?
No. Backup is a restore capability. Data lifecycle and records management decide how long information should remain available for business, legal or regulatory reasons, and when it should be disposed of. They solve different problems.
Do you implement records management separately from retention?
Not as two thin pages. Retention labels and policies (data lifecycle) and records declaration, restrictions and disposition review (records management) are designed together so a record is not just a renamed retention label.
Will this delete things we still need?
Not if it is designed against actual obligations. We start from what you must keep and what you may dispose of, then configure labels and disposition review. Automatic deletion without a reviewed model is how programmes lose trust.
Related Purview services
Other Ghani Governance Microsoft Purview services on this hub that often sit alongside data lifecycle and records management:
- Policy to Purview design — mapping written retention obligations before labels and disposition go live
- Unified Catalog and data governance — ownership and glossary that retention alone cannot invent
- Microsoft Purview eDiscovery — holds and collections that must coexist with retention and disposition
- Sensitivity labels and information protection — classification alongside retention labels
- Compliance Manager — assessment programmes that may surface retention-related improvement actions
- All Microsoft Purview services — full hub list
Book a discovery workshop
A scoping conversation about what you need to protect, what is already configured, and what must not break.