As AI adoption and Digital Transformation accelerate, organisations are generating more data than ever before, making data deletion, governance and regulatory compliance critical boardroom priorities, says Prashant Kale, Chief Technology Officer, Scrumconnect.
As AI adoption and Digital Transformation accelerate, organisations are generating and collecting more data than ever before. Every day, information is created, shared and stored across countless platforms, systems and tools. While most organisations are focused on how to get more value from that data, far fewer are asking a harder question: what happens to the information they no longer need?
For years, deleting information was treated as a technical task handled quietly by IT teams in the background. Data reached a retention threshold, systems archived or deleted it and operations continued uninterrupted. But growing regulatory scrutiny and increasingly complex digital environments are exposing the limits of that approach.
Under UK GDPR, organisations are expected to delete personal data once it is no longer needed for its original purpose. At the same time, regulators are paying closer attention to how organisations manage retention and deletion decisions, particularly where unnecessary information is being held for too long.
Organisations are now under greater pressure to show clear oversight of how information is managed across its lifecycle. What was once viewed as operational housekeeping is increasingly becoming a matter of organisational accountability.
Why legacy systems are struggling to keep pace
Many enterprise systems were never designed with today’s governance expectations in mind.
Traditional ERP platforms were designed primarily to support day-to-day operations. Retention policies were often fixed and governance expectations far less complex than they are today.
Today’s businesses operate very differently. Information is continuously copied and shared between systems, often with limited visibility once it leaves its original source. As organisations modernise, these environments become harder to govern consistently.
This creates a growing challenge for organisations still relying heavily on legacy infrastructure. Deleting a record from a core system does not necessarily mean it has disappeared completely. In many cases, duplicate or forgotten copies of information remain elsewhere across the organisation.
In practice, many organisations are discovering that their governance processes have not evolved at the same pace as their technology estates. The result is a widening gap between what regulators increasingly expect organisations to evidence and what many systems are realistically able to demonstrate.
Governance is no longer just a technology concern
As these pressures increase, responsibility is moving higher up the organisation.
Boards are increasingly expected to understand how information is governed across the business, particularly where data management decisions intersect with legal risk, operational resilience and public trust.
This is reflected more broadly in boardroom priorities, with KPMG’s 2025 Board Agenda highlighting AI oversight, cybersecurity and data governance as some of the most significant issues now shaping boardroom discussions.
Regulators are also placing greater emphasis on whether organisations can justify how information is managed throughout its lifecycle, not simply whether systems are technically compliant. Organisations are being expected to explain why information has been retained and how deletion policies are being applied across the business.
That becomes particularly difficult in fragmented digital environments where ownership is often split across teams, suppliers and platforms. In many cases, leadership teams remain accountable for decisions being made across systems they cannot fully see or directly control.
As a result, data governance is becoming part of a much wider conversation about organisational accountability and risk management, rather than sitting solely within IT or compliance functions.
Why organisations are struggling to keep up
Deciding when data should be deleted is rarely straightforward. Organisations may need to remove information under data protection rules while also retaining certain records for legal claims, audits or regulatory reviews. Keeping unnecessary data for too long can also create additional compliance and security risks.
Many organisations are struggling to manage these decisions consistently across large and often fragmented technology estates. Policies may exist on paper, but applying them across interconnected systems is far more difficult in practice.
This is where many legacy governance models begin to fall short. Retention schedules often remain static, even as regulatory and business requirements continue to change. In some organisations, governance processes still rely heavily on manual oversight and fragmented ownership.
Organisations are finding they need stronger visibility across data flows, clearer ownership and governance processes that work in practice, not just on paper. There is also growing recognition that governance needs to be considered much earlier in transformation programmes, rather than added once systems are already in place.
What organisations need to focus on next
For many organisations, the immediate challenge is understanding what happens to information once it moves beyond the ERP itself. Data can pass through reporting tools, integrations and third-party platforms before anyone has full visibility of where it ultimately resides. That makes retention and deletion decisions far harder to apply consistently in practice.
Organisations now need to take a far more active approach to how data is governed across the business. That starts with understanding where information moves after it leaves core systems and whether existing retention policies still reflect current regulatory requirements.
Organisations need to be confident that they can clearly evidence deletion decisions if they are ever challenged. Governance cannot sit solely within IT or compliance teams.
There is also a growing need to build governance requirements into transformation programmes from the outset, rather than attempting to retrofit them later. As systems become more connected, organisations need processes that apply retention and deletion policies consistently across increasingly complex environments.
Data deletion may once have been viewed as a background IT process, but organisations are now facing far greater scrutiny over how information is retained, managed and removed across the business. For many, the challenge will be having the evidence needed to clearly explain those decisions when regulators or stakeholders come asking questions.
