Data retention & disposal policy for GCP

[HArchuleta_Mimo]

I've been tasked with writing a data retention & disposal policy for our company.

Since we use GCP, much of the data we deal with resides in the Google Cloud since we do not store any data locally.

Is there any way to find out with the data retention/disposal policy for GCP?

The GC services we use are as follows:

Compute Engine, Firestore,  Cloud Storage for Firebase 

[ErnestoC]

Custom data retention policies can be implemented in both Cloud Firestore and Cloud Storage.

In Cloud Storage, a Bucket Lock will enforce a chosen retention period on a bucket's objects, so that they cannot be deleted until the retention period is met.

For Cloud Firestore, data lifecycle management is carried out through TTL policies. A collection group in Firestore can be managed by a single TTL field that holds the expiration date. Documents will be automatically deleted within 72 hours after the expiration time.

If you were instead searching for Google Cloud's retention and management of its customer's data, the official details are viewable at the Cloud Data Processing Addendum. Specific information can be found at Section 6 (Data Deletion) in the agreement.

[alexmoore]

Some great resources from Ernesto, another useful reference might be this article: https://cloud.google.com/docs/security/deletion

[HArchuleta_Mimo]

Thanks, ErnestoC & alexmoore, I appreciate your replies. I think my question wasn't as clear as I thought it was. I was referring to DR/DD policies with respect to all GC projects. Not sure if this information is readily available since the company is utilizing the "free" resources of GC. 

[ErnestoC]

The documentation shared by alexmoore highlights, in more detail, the procedure and timeline applicable to all Google Cloud Projects and resources when they are requested for deletion. This deletion process or pipeline begins from 3 scenarios:

1. GCP Resource deletion
2. GCP Project deletion
3. GCP Account deletion

An initial soft deletion process is started by Google Cloud, which lasts up to 30 days from the deletion instruction date. During this stage, the data might be recovered by a Google Cloud Customer. After soft deletion, the data is removed from active Google Cloud storage systems. After two months from the resource or project deletion, any data is then finally removed from any backup storage within Google Cloud. The entire pipeline process is set to take approximately 6 months to complete.

[JerryUStall]

For GCP, Google has some comprehensive documentation on data retention and disposal policies that can be super helpful.

Since you're using Compute Engine, Firestore, and Cloud Storage for Firebase, you'll find specific guidelines tailored to these services. I'd recommend checking out the official Google Cloud documentation for each of these services to get detailed insights into setting up your policy.

And if you're looking for some additional tips and best practices in data preparation, this link https://www.nannostomus.com/data-wrangling/data-preparation/ might provide you with some valuable information. Best of luck with your policy creation – you're on the right track!