A business unit wants to retain records well beyond the approved retention period “just in case they might be useful later”. There is no legal hold and no documented business justification.
What would you do?
- Enforce disposal strictly?
- Allow an exception?
- Ask for justification and document the decision?
- Escalate the risk?
Explain your reasoning, not just your decision.