As part of GDPR, there needs to be a data retention policy. This policy will allow the deletion, or anonimization of personally identifiable information for inactive clients after a period of time.

Automation Task

An automation task called "Data Retention Cleanup" should be created that runs once daily at a specified time. The task should perform 2 possible actions:

1. Mark clients as "Inactive" if they have: No open or recurring invoices, transactions, or active services for a specified period of time, and log the date/time of the status change.
2. Delete or anonymize personally identifiable information for clients that have been inactive for a specified period of time, double checking that the client still has no open or recurring invoices, or active services.

Settings

Add a Client Group setting group called "Data Retention Policy" with the following options:

• [x] Enable Data Retention Policy (Unchecked by default, if checked, display the remaining options)
• Mark clients inactive after X months (1-72 months) Tooltip: Clients are marked inactive after they have no active services, recurring invoices, or open invoices for this amount of time.
• Delete or anonymize inactive clients (SELECT WHICH, DELETE IS ALWAYS PERMANENT) after X months (1-72 months & Never as an option which will only mark clients inactive per above) Tooltip: Clients that have been marked inactive for this period of time, who have no active services, open or recurring invoices will be deleted or anonymized.

Clients that can be deleted should be deleted. For example, if there are no transactions, invoices, or services of any status, they may be deleted. If there are transactions, invoices, or services, the following should happen:

• Personally identifiable information should be anonymized.
• Any logs pertaining to the customer should be removed, including: Login logs, contact information change logs, and anything else stored in MySQL. Monolog file logs rotate out automatically and do not need to be considered.