Defines purpose, lawful or consent basis, user rights and controls, retention, disclosures, and exceptional cases for data retention. It fixes adoption boundaries and observable failure evidence while keeping environment-specific limits configurable.