Documented schedule for how long each data category is retained and how it is securely disposed of.
A Data Retention Policy defines, per data category, how long records are retained, the legal/business justification, and the method of secure disposal at end of life. Most frameworks require both a written policy and operational evidence of deletion.
Run a free ComplianceIQ audit against GDPR and we'll surface every gap on this — and the other controls auditors flag — with the exact clause references to fix.