What it asks for. Information within the system and output from it must be managed and retained in line with applicable laws, regulations, policies, standards and operational requirements.
In practice. Good practice is a retention schedule that states how long each information category is kept and why, applied through automated retention and deletion in storage and SaaS platforms, with legal hold procedures. Auditors expect the schedule, configuration of retention settings and records of deletion. For European organisations this ties directly to the GDPR storage limitation principle. Retention should cover structured and unstructured data, including email, chat and collaboration tools.
Common gaps. Organisations often keep everything indefinitely because deletion feels risky, which increases breach impact. Retention rules are rarely applied to backups, logs and data exports. Nobody may be clearly accountable for applying the schedule in each system.