Data as a Liability

Zero data retention: what it is and what it actually buys you

• ISO 27001 A.8.10 Information deletion
• ISO 27001 A.8.15 Logging
• ISO 27001 A.5.33 Protection of records
• ISO 42001 A.7 Data for AI systems

Zero data retention is an arrangement where a vendor handles your information and does not keep a copy. You send something over, you get an answer back, and nothing is stored on their end. The phrase gets shortened to ZDR in contracts and sales decks. It comes up most often with artificial intelligence vendors, but the idea is older than that.

The case for it is straightforward

You cannot lose what you do not have. A breach at a vendor who stored nothing is a much shorter phone call than a breach at one who stored six years of your files.

Legal bills get smaller. When a lawsuit starts, both sides go through relevant records. Lawyers read them at hourly rates. That cost climbs with the size of the pile. A smaller pile is a smaller invoice.

Deletion requests get easy. When a customer asks you to erase their information, "we never kept it" is a much better answer than a four-week scavenger hunt across nine systems.

And regulators already expect this. Collecting only what you need and keeping it only as long as you need it is not a new idea. It is written into privacy law in Europe and in most U.S. state privacy statutes. Zero data retention is old advice wearing a new name.

The case against it is just as real

You lose the trail. Something goes wrong and you want to know what happened, who did it, and when. You cannot investigate what you threw out last Tuesday.

You lose your proof. Auditors do not take your word for it. They ask you to show that a control operated, repeatedly, over a period of months. "We deleted it" is not evidence. It is the absence of evidence, and those are graded differently.

Retention rules still apply to you. Financial reporting rules, health records rules, and broker-dealer rules all require you to keep certain records for years. A vendor arrangement does not override a federal record-keeping obligation. If anyone tells you it does, get that in writing and watch them decline.

Routine deletion can become destruction of evidence. Deleting on a schedule is fine right up until the day you should reasonably have known a lawsuit was coming. From that point forward, the same automated cleanup job that was good hygiene last month is now something a judge may call spoliation, which is the legal term for destroying evidence. Courts can sanction a company for it, and sometimes the sanction is instructing the jury to assume the missing records were unfavorable.

And the newer artificial intelligence rules push in the opposite direction. The European Union's Artificial Intelligence Act requires record-keeping and logging for systems it classifies as high risk. So a company can end up with a data minimization policy and an artificial intelligence governance policy that contradict each other, each signed by a different executive, neither aware of the other.

The same tension sits inside a single standard. ISO 27001 asks you to delete information deliberately, under the information deletion control at A.8.10, and to protect records from loss under A.5.33. It also asks you to keep logs under A.8.15. Those are not contradictory requirements, but they are frequently read as though the first one wins, and a company that deletes its logs to satisfy A.8.10 has quietly failed A.8.15. ISO 42001 adds a further pull toward keeping things, because its data controls expect you to know where the data behind an artificial intelligence system came from and how it was handled, which is difficult to evidence if the trail was discarded.

None of this means keeping more. It means the deletion decision and the logging decision are the same decision, made once, by someone who can see both obligations at the same time.

Safety and abuse monitoring may keep a copy. Subcontractors may keep a copy. Temporary storage used to speed things up may hold material longer than anyone realized. And the most common leak of all is the help desk, where a support ticket about a problem contains a screenshot of the very data the contract said was never stored.

If the salesperson cannot answer those in one meeting, you do not have zero data retention yet. You have a slide.

Human oversight, or keeping a human in the loop, and why it is not a free pass

• ISO 42001 A.9 Use of AI systems
• ISO 42001 Clause 7.5 Documented information

Nearly every artificial intelligence policy written in the last two years contains some version of the same sentence: a human reviews the output before it is used. This is usually called keeping a human in the loop. It is a reasonable control, and it is treated as a settled matter far too quickly.

Three things about it do not get said out loud.

A human reviewer creates data. To review something, a person has to look at it. Now it is on a screen, in a ticket, in a chat message to a coworker, in a screenshot pasted into a shared document. Sensitive material has left the system you carefully locked down and landed in four tools nobody assessed. The review step, by design, spreads the information around.

A reviewer who never disagrees is not a control. If your approval rate is one hundred percent, you do not have oversight. You have a rubber stamp with a salary. People tend to trust what the machine tells them, especially under time pressure, and especially when the machine is right most of the time. The useful measurement is how often the reviewer overrides the output. Zero is not a good score. Zero is a warning.

Human review and zero retention work against each other. A reviewer needs context to make a real judgment, and context means keeping history. The more seriously you take one, the harder the other becomes. That is a genuine tradeoff, and it should be made on purpose by someone senior, not settled by accident in a vendor configuration screen.

There is also a version of this that is worth naming plainly. Human review is sometimes used to park responsibility on whoever is lowest on the org chart. If the only name attached to a decision belongs to a contractor making nineteen dollars an hour with four seconds to click approve, nothing has actually been reviewed. Liability has just been moved somewhere it will be harder to defend.

The question for the audit committee is short. How often does our reviewer disagree with the system, and does anyone track it? If nobody knows, you do not have a control. You have a job title.

ISO 42001 is unusually direct on this point. Its controls covering the use of artificial intelligence systems ask for human oversight and for records of the decisions made, not merely a policy stating that oversight happens. That distinction is the whole thing. A policy is a sentence. An override log is a control, and it is the artifact an auditor will ask to sample.

Court orders, or the day your retention policy stops being yours

• ISO 27001 A.5.33 Protection of records
• ISO 27001 A.5.34 Privacy and PII

Every company has a schedule saying how long records are kept. That schedule holds until someone sues, or is about to. At that point a duty to preserve attaches, the routine deletion has to stop, and the schedule becomes advisory.

If you hold ISO 27001, this is where the protection of records control at A.5.33 earns its keep or exposes you. A certified organization is expected to protect records against loss and to handle them in line with legal obligations. An automated deletion job that runs straight through a preservation duty fails that control, and it does so in the one setting where the failure is discoverable by an outside party who is not your auditor.

The clearest recent illustration involves OpenAI, and the timeline teaches more than the headline did.

Four lessons come out of that, and none of them are about OpenAI specifically.

A vendor's privacy promise does not bind a judge. Your contract is between you and the vendor. A court is not a party to it. When those two conflict, the court wins, and your contract does not get a vote.

Deleted does not always mean deleted. Material users had asked to have removed was swept into the preservation order anyway. If your privacy notice tells customers their information is erased on request, you should know whether that is true under all conditions, not just normal ones.

The contract tier mattered enormously. Business customers with a genuine zero data retention agreement were not affected. Enterprise accounts were treated differently as well. Standard consumer accounts were not protected. So the practical question for your organization is not whether your company signed a good agreement. It is which tier your people are actually using, including the ones expensing a personal subscription and pasting company material into it. That is where the exposure lives, and it usually is not in the vendor inventory.

Volume created the fight. The court noted the company was retaining logs in the tens of billions. That is precisely why a twenty-million-record sample was considered a reasonable and proportionate request. A smaller pile would have produced a smaller argument.

And one more that applies to you rather than your vendor. Your own retained records are discoverable in somebody else's lawsuit. You do not have to be a defendant to spend four hundred thousand dollars responding to a subpoena.

Third-party audits and ISO certification, because evidence is data too

• ISO 27001 Clause 7.5
• ISO 27001 Clause 9.2 Internal audit
• ISO 27001 A.5.20 Supplier agreements
• ISO 42001 A.10 Third-party relationships

Here is where the whole thing gets reconciled, and the principle is simple enough to say in one line: keep the receipt, not the cargo.

You generally do not need to retain the underlying content to prove a control worked. You need to retain proof that it worked.

The receipt package is small, it is boring, it is far less dangerous in a breach, and it is exactly what an auditor asks for.

What you cannot do is delete carelessly and expect a clean opinion anyway. An audit that covers a period of time requires evidence across that period, and testing requires a complete population to sample from. If you cannot produce a list of everything that happened, no sample can be drawn from it, and the opinion suffers. A company that deletes without designing for evidence has not reduced its risk. It has made itself unauditable, which is its own kind of finding.

How this plays out in an ISO 27001 or ISO 42001 audit

Certification audits are unforgiving about this in a specific way. Both standards run on documented information, which is the formal term for the records that prove the management system is operating. A certification body samples those records. It does not accept a description of what normally happens. Internal audits, management reviews, and corrective actions all have to be evidenced across the period, and a surveillance visit a year later will look for the same trail again.

ISO 42001 adds a second demand. Its data controls expect provenance, meaning you can say where the data behind an artificial intelligence system came from and what was done to it. Provenance is a record, not a recollection. A retention decision that discards the trail does not just create legal exposure. It creates a nonconformity.

There is also a governing document in both standards that most executives have never seen. The Statement of Applicability lists every control the organization decided applies, and justifies every one it excluded. If your retention and deletion practices do not match what that document claims, the gap is written down, signed, and sitting in the auditor's folder.

Then there is the piece almost nobody schedules. Your auditors are a retention risk. During fieldwork you will upload screenshots containing live customer information, export system reports, and share files through portals. Those workpapers get kept for years, because professional standards require the firm to keep them. They sit on the firm's systems, sometimes on an individual's laptop, sometimes with a subcontractor helping with testing. You went to considerable trouble to control where your data lives, and then handed a copy to an outside firm with a retention schedule you have never read.

Ask four questions before the next engagement. Where does our evidence go. How long is it kept. Who else at the firm, or outside it, can see it. What happens to it when the engagement ends.

Last point on audits, and it is the cheapest improvement available. Read the report, not the cover letter. Vendor audit reports contain carve-outs for systems that were not examined, lists of subcontractors whose controls were not tested, and a section describing the controls the vendor assumes you are running on your end. That last section is the one that matters most and gets read the least. Plenty of companies file a clean report in a folder while sitting in breach of a half-dozen assumptions that report made about them.

An ISO certificate has the same trap in a smaller space. The scope statement on the certificate defines which parts of the business and which services were actually assessed. A vendor can hold a legitimate ISO 27001 certificate whose scope covers a corporate office and excludes the platform you are buying. The certificate is real. It is simply not about the thing you care about.

What this looks like when it is done well

Six changes, all of which belong at the board level rather than in the technology department.

1. Classify by what it costs to keep, not by what it is worth to have. Run the exercise once. For each major category of information, ask what it would cost if it appeared in a news story, a subpoena, or a regulator's letter. The rankings will not match your current priorities, and the mismatch is the finding.
2. Give the retention schedule a real owner and connect it to legal hold. A retention schedule nobody owns is a document, not a control. It needs a name attached and a working connection to the legal team, so the deletion stops automatically when preservation begins. If you are certified, this is the same evidence ISO 27001 expects under protection of records and information deletion, so the work counts twice.
3. Default to receipts rather than cargo. Make control records the standard evidence and full content the exception that someone has to justify in writing.
4. Write contracts that define their own terms. Zero data retention should be defined in the agreement, extended to subcontractors by name, and paired with a commitment to notify you when legal process arrives, to the extent the law permits. ISO 27001 supplier agreements and ISO 42001 third-party controls both expect these terms to be written down rather than assumed.
5. Measure how often your human reviewers disagree. Report the number quarterly. It is one of the few honest measures of whether oversight is real, and it is the record ISO 42001 asks for when it requires human oversight of AI systems.
6. Rehearse the preservation order before you receive one. Know who gets the call, who can stop automated deletion, how fast it can be stopped, and which vendors must be notified. The first one you get should not also be the first time anyone has thought about it.

None of this argues for keeping nothing. Some records are worth their carrying cost several times over, and a company that deletes everything has simply traded one set of problems for a worse one.

The change is in which question gets asked first. For twenty years it was: what could we do with this if we kept it. The better question, and the one that belongs in the boardroom, is: what happens to us if we keep it and something goes wrong.

Both questions deserve an answer. Only one of them has been getting asked.