Apply a retention rule, respect a legal hold, and prove the deletion

applied · 50 min · Objective 5.2

Task

The retention policy keeps orders for nine months. On 2026-01-01, remove every order dated before 2025-04-01 -- except those of two customers under legal hold -- and produce the evidence an auditor would ask for.

Steps

  1. Customers C0048 and C0130 are under legal hold: none of their orders may be deleted.
  2. Write lab/retain/orders-kept.csv with the same header as data/orders.csv, holding every order dated 2025-04-01 or later, plus held customers' older orders.
  3. Write lab/retain/disposal-log.csv with header order_id,deleted_on,rule, one row per deleted order, deleted_on 2026-01-01 and rule retain-9-months.
  4. Write lab/retain/proof.txt with the lines before: N, deleted: N, held: N and after: N, and deleted ids sha256: with the SHA-256 of the deleted order ids, sorted, one per line.

Verify

These checks run in a POSIX shell with Python 3: Terminal on macOS or Linux, and on Windows Git Bash (it comes with Git for Windows) or WSL. On Windows, python3 is often a Microsoft Store placeholder that prints “Python was not found”; run alias python3=py in Git Bash first.

grep -E '^(before|deleted|held|after): ' lab/retain/proof.txt
awk -F, 'NR>1 && $2 < "2025-04-01"' lab/retain/orders-kept.csv | cut -d, -f3 | sort -u
echo "log rows: $(($(wc -l < lab/retain/disposal-log.csv) - 1))"

2000 before, 489 deleted, 4 held and 1511 after. The only old orders left belong to C0048 and C0130, and the disposal log has 489 rows, one per deletion. The hash of the deleted ids lets an auditor confirm which records went without the log keeping the records themselves -- a disposal log that copied the data would defeat the deletion.

This is an independent study companion for CompTIA Data+ DA0-002 and is not produced by or endorsed by CompTIA.