Clear Path step · Business · A plan before you need it
Keep less: set retention and delete what you don't need
Why it matters: Data you don't hold can't be stolen, ransomed or decrypted later. It is the cheapest protection against breaches today and against stolen encrypted data being cracked in future.
Best after: Name an owner and map what you'd lose
Do it
- List the sensitive data you hold: IDs, tax numbers, bank details, health information, card data, client files.
- Set a keep-for period for each, based on legal and business need.
- Delete or move to offline archive anything past it, starting with old exports and email attachments.
- Stop collecting fields you don't use, such as full birth dates or ID numbers.
- Repeat once a year.
Check it worked: You've written how long you keep customer, employee and financial records, old data past that date is deleted or archived offline, and you collect only what you need.
Simply put
It's like shredding old files instead of keeping every box in the basement forever. Data you no longer hold can't be stolen, ransomed or decrypted later, which makes deleting it one of the cheapest protections against breaches.
In detail
Attackers can store encrypted data now and decrypt it once quantum computers are capable; NIST's draft transition plan (NIST IR 8547) proposes phasing out today's public-key algorithms over the next decade. Most small businesses can't speed up that migration, but they can shrink what's exposed to it.
Points toward the Long View: less stored data for anyone hoping to decrypt it once quantum computers can.