Legacy Capsule Legal-Retention Map
Status: APPROVED under DPO decision D-051-01 (2026-05-20, approved with conditions).
This map satisfies condition #1 of the counsel reply (gdpr-art17-counsel-thread-legacy-capsule-erasure-reply.md): each retained legacy capsule category must be mapped to an applicable retention/audit obligation or defensible legal-claims need.
The map is the authoritative reference cited by the actor.erasure.legacy_capsule_refused audit event (mapped_obligation / retention_expires_at_or_criteria). It is implemented in code at src/EvidenceLocker/.../Infrastructure/Db/LegacyCapsuleRetentionMap.cs and is deterministic and offline.
Capsule class (manifest.kind) | Mapped retention obligation | Retention expiry / criteria | Art. 17(3)(b) primary | Art. 17(3)(e) secondary |
|---|---|---|---|---|
DecisionCapsule | DORA Art. 28 (ICT third-party / Register of Information evidence) + Art. 5 (ICT risk-management documentation); CRA Annex I conformity record retention. | Retain for the mapped DORA/CRA statutory audit-retention period (default 5 years from seal) plus active litigation hold; DPO annual review. | Yes | Yes (release-decision evidence is reasonably necessary for defence of regulatory/contractual claims). |
tlpt-evidence-pack | DORA Art. 26/27 Threat-Led Penetration Testing evidence retained for competent-authority supervision. | Retain 10 years from seal (DORA TLPT evidence default) plus active litigation hold; DPO annual review. | Yes | Yes. |
dora-roi-snapshot | DORA Register of Information (RoI) supervisory evidence retained for ESA/competent-authority reporting. | Retain for the DORA RoI retention period (default 10 years) plus active litigation hold; DPO annual review. | Yes | No (supervisory reporting obligation alone). |
| default / unmapped class | DORA Art. 5/6 ICT risk-management documentation + Art. 17 incident records; NIS2 Art. 21/23 retention. | Retain until the statutory audit-retention period for the mapped obligation expires, plus any active litigation hold; reviewed annually by the DPO. | Yes | No. |
Notes
- No less-intrusive technically equivalent alternative exists. Deleting or rewriting the manifest breaks the original cryptographic attestation; re-signing would not preserve the original evidence object (counsel condition #2).
- Retention expiry is defined for every class (counsel condition #7) — either a concrete period from seal or a “statutory period + litigation hold” criterion.
- Categories, not values. The audit event records the categories of retained personal data (e.g.
email,ip_address,display_name,user_agent), never the raw values. - Review cadence. The DPO reviews this map at least annually and whenever a new capsule class is introduced. New classes must be added here before they can be cited in a refusal; until then the default ICT-evidence obligation applies.
Cross-references
- Operator policy + requester wording:
docs/modules/evidence-locker/legacy-capsule-erasure-policy.md - Compliance pack mapping:
docs/legal/compliance-pack-mapping.md - DPO decision (counsel reply):
docs/legal/decisions/gdpr-art17-counsel-thread-legacy-capsule-erasure-reply.md