What's changed: Created Associate Google Workspace Administrator Chapter 3 (Domain 3 "Governance/compliance": data retention and eDiscovery = Vault retention rules/holds (override deletion)/search-export; data protection = DLP detect-block/data regions/trust rules/label classification).
3.1Data retention and eDiscovery (Vault)
Understand Google Vault retention rules (retain data for a period / delete after it), holds (preserve specific users data), eDiscovery via search and export, and the precedence of retention vs deletion (a hold overrides deletion).
Organizations must retain data only for the right period and, when needed, retrieve it legally. In Google Workspace, Google Vault handles this—the central tool for data governance.
3.1.1Retention rules and holds
A retention rule specifies "retain for a period, then delete" for mail, Drive files, etc. (org-wide or per OU). A hold (litigation hold) preserves specific users/targets data from deletion for litigation or investigation. The key is precedence: a hold overrides a retention rule deletion (data is preserved even if a user deletes it during a hold). Map "retain/delete by period = retention rule" and "preserve reliably for investigation = hold (overrides deletion)."
3.1.2eDiscovery (search and export)
eDiscovery is the flow of searching preserved data by criteria (user, period, keywords) and exporting it as evidence. In Vault, create a matter, search the targets, and export the needed data. Map "legally search/export past mail/files = Vault eDiscovery."
Common: requirement → means. E.g., "retain mail for 2 years then delete" = retention rule; "reliably preserve a user data for litigation" = hold (overrides deletion); "search past data by criteria and export" = eDiscovery (search/export); "hold wins even with a retention rule" = hold precedence.
Watch the mix-ups: (1) Retention rules (retain/delete by period) and holds (preserve) differ, and a hold overrides deletion. (2) eDiscovery is search/export of already-preserved data; preservation itself is done by holds/retention. (3) Vault depends on license/edition.
3.1.3Section summary
- Retention rule = retain for a period, delete after (org/OU)
- Hold = preserve data for investigation/litigation, overriding retention deletion
- eDiscovery = search by criteria and export as evidence (Vault matters)
Sign in to track progress — Log in.
Quick check
(just a quick review)Q1. To retain mail for 2 years then auto-delete, what do you set in Vault?
Q2. To reliably preserve a specific user data from deletion for litigation, what do you use?
Q3. When a retention rule and a hold both exist, which is correct about the data?
Q4. To search past mail/files by criteria and export them as evidence, what do you use?
Q5. Which correctly describes eDiscovery?
Q6. At what scope can a retention rule typically be applied?