Data retention policy clarifies the data that is to be stored or archived. An IT consulting firm controls how it saves the data for regulatory needs.