Log Retention

Explanation

Log Retention checks that the prompts and model responses captured by AI systems - which in banking often contain customer names, account numbers, and other personal data flowing through Summarization & Chat, RAG, and Document Extraction - are minimised, masked, retained only as long as needed, and then purged, so that operational logs do not become an uncontrolled store of personal information. It is measured by Prompt/Response Log Retention & Minimization, which assesses whether personal data in logs is masked and whether retention and purge schedules follow policy. To implement it, instrument the logging layer to detect and redact or tokenise personally identifiable information before logs are written, tag each log entry with a retention class, run automated purge jobs that delete or anonymise records once their retention window expires, and keep auditable evidence of masking coverage and purge execution. This is an Immediate-priority control. The threshold requires that PII is masked in logs and that retention and purge follow the DPDP policy (India's Digital Personal Data Protection regime), aligning with RBI Data Privacy, NIST MANAGE 2.2 data-lifecycle guidance, and ISO records control. A breach - unmasked PII appearing in logs, or records retained past their schedule - should trigger an alert, immediate redaction or deletion, and a review of the logging configuration and data-protection sign-off.