Data Retention & Deletion Requests

Who this guide is for: Tenant administrators responsible for privacy compliance — configuring how long session recordings are kept, and handling data-subject deletion requests under Quebec Law 25 / PIPEDA.

EmbayLMS enforces a fixed retention schedule automatically. A nightly job permanently removes data that has reached the end of its legal retention period and irreversibly anonymizes personal information that must be removed while the underlying training records are retained.

Important: retention purges are permanent. Unlike deleting a course or a user in the admin UI (which can be restored from the trash), data removed by the retention schedule is destroyed and cannot be recovered.

What is retained, and for how long

These periods come from the EmbayLMS data retention policy and meet the legal training-record obligations common to regulated industries. Only the recording period is configurable per tenant; the others are fixed.

Configuring recording retention

1. Go to Admin → Settings.
2. Open the Data retention section.
3. Set Session recording retention to a value between 30 days and 7 years (default: 1 year).
4. Save. The change applies from the next nightly retention run and is recorded in the audit log.

You will receive an email 30 days before any recording is removed, with the list of affected sessions, so instructors can download anything worth keeping. Each session triggers this notice only once.

Configuration reference

Handling a deletion request (Law 25)

When a learner (or former employee) asks for their personal information to be deleted, Quebec Law 25 gives you 30 days to respond. EmbayLMS resolves the central conflict for you: completed training records often must be kept for 7 years, but the person’s identity does not.

Step 1 — Verify the requester’s identity. Confirm the request really comes from the account holder (for example, a reply from the registered email address). Do this before touching anything in the LMS.

Step 2 — Process the request. Go to Admin → Users, open the user, and choose Process deletion request. Enter a short note describing how you verified the identity (do not include personal details in the note).

Step 3 — What the system does, automatically:

• The user’s name becomes an anonymous code (anon_…), the email address is replaced with a non-routable anonymized address, and the employee ID and custom profile fields are cleared. This cannot be undone — no link between the code and the person is kept anywhere.
• Passwords, authenticator (MFA) secrets, and backup codes are destroyed.
• Notifications and personal preferences are deleted.
• Personal details inside historical audit entries are redacted.
• Completed training records and certificates within their 7-year retention period are kept, anonymized. Certificates remain verifiable by their certificate number but show no personal name.
• If the user has no records under retention, the account and all its data are deleted entirely.

Step 4 — Respond to the requester. The system returns an itemized summary — what was deleted, what was anonymized, and the legal basis for anything retained. Send this summary to the requester to close the request within the 30-day window.

What you do NOT need to do

• Schedule anything. The retention job runs nightly, per organization.
• Delete deactivated users manually. 90 days after deactivation their identity is anonymized or removed automatically.
• Worry about backups. Deletions and anonymization propagate through all retained backups within 35 days, and are re-applied if a backup is ever restored.

Audit trail

Every retention run and every deletion request writes an audit log entry (actor system for scheduled runs, or the processing administrator for deletion requests) with record counts only — never personal information. These entries are your compliance evidence for auditors and the Privacy Officer.

Troubleshooting