How do I set up a new document retention policy in Acrobat?

First, go to the Enterprise Admin Guide. Find the section on 'Security policies in Acrobat'. Use the guide 'Creating and managing document-security policies' to make a new policy. Set the number of days for retention (1 to 5475 days). Decide if the policy needs a password or certificate. Apply this policy to documents when they are in their final state.

What is the difference between password-based and certificate-based security policies in Acrobat?

Feature Password-based Policy Certificate-based Policy. How it works Requires a password to open or change document settings. Uses a digital certificate for security, often tied to a user's identity. Ease of use Easier to set up for individual users or small groups. More complex setup, usually managed by IT for larger organizations. Security level Good for general protection, but passwords can be shared or forgotten. Stronger security, as certificates are harder to copy or misuse.

Enforce Departmental Retention in Adobe Acrobat — How-to & AI prompts

AI prompts

2 ways to ask · copy any one

AExecute — “help me do it”Implement automated retention by creating file attachment security policies and configuring…+

Implement automated retention by creating file attachment security policies and configuring encryption for classes of records, then apply those policies to the [folders=accession and administrative record folders] so retention rules trigger without ad‑hoc decisions.

when the reply comes backPush once: ask it to sharpen the weakest part, and to say what it assumed.

BImprove — “do it better”Make retention enforcement defensible and low‑maintenance: map departmental retention schedules…+

Make retention enforcement defensible and low‑maintenance: map departmental retention schedules to named [policy] security policy profiles, configure file attachment security policies with retention dispositions and encryption, test policy application on a representative accession [batch], and document who approved the mapping so audits don’t flag inconsistent disposal.

when the reply comes backPush once: ask it to sharpen the weakest part, and to say what it assumed.

How to do it

the tool · the steps · what to avoid

1
Sign in to the Adobe Admin Console with an account that has administrative privileges.
2
Navigate to the Users section to review and confirm the list of users or groups you want to manage.
3
Export the current user or group list as a CSV file if you plan to apply retention rules via bulk import.
Best practiceUsing CSV import allows you to efficiently manage large numbers of users and minimizes manual errors.
4
Open Acrobat Sign settings or navigate to the retention policies area within the Admin Console.
5
Select the option to create a new retention rule or update an existing rule, specifying the desired retention period and policy settings.
CautionEnsure your retention policy aligns with your organization's compliance and data governance requirements.
6
If using CSV import, prepare your CSV file to include the users or groups and the retention rule to be applied.
7
Import the CSV file or, if working in the UI, select multiple users or groups and apply the retention rule to all selected.
8
Review the list of affected users or groups to confirm the retention rule has been correctly applied or updated.
Best practiceAfter applying changes, use the filtering and reporting features to audit retention policy assignments across your user base.

In the appWith the API

You can use the Admin Console’s bulk import feature to quickly apply retention rules to many users at once.

The Acrobat Sign API offers endpoints for managing users and groups, but retention rule assignment is typically managed via the Admin Console or CSV import.

Glossary

words on this page

Retention PolicyA set of rules that decides how long documents are kept and how they are handled.ExampleOur company's retention policy states that all invoices must be kept for seven years.

Terminal StateThe final stage of a document, after which no more changes are expected.ExampleOnce approved and archived, the contract reached its terminal state, meaning no further edits were allowed.

AdminA person who has special rights to manage settings and rules for an account or group.ExampleThe Admin can change user permissions and reset passwords for everyone on the team.

The real tasks

the one, listed here

Ensure departmental retention rules are applied automatically to whole classes of records instead of making ad-hoc decisions each time.

FAQ

about this task

First, go to the Enterprise Admin Guide.
Find the section on 'Security policies in Acrobat'.
Use the guide 'Creating and managing document-security policies' to make a new policy.
Set the number of days for retention (1 to 5475 days).
Decide if the policy needs a password or certificate.
Apply this policy to documents when they are in their final state.

A reusable policy set is a group of security rules, like retention times, that you can use again and again for different documents. This saves time because you do not have to create the same rules for each file. It helps keep all your documents safe in the same way.

Acrobat Security Policies can help you follow HIPAA rules by letting you set specific retention times for sensitive documents. HIPAA requires you to keep patient information for a certain period. With Acrobat, an administrator can create a policy that forces documents to be kept for that exact time. This helps ensure your company meets legal requirements and avoids problems.

Retention policies are applied at the 'terminal state' because this is when a document is considered final and complete. Before this, a document might still be changing. Applying the policy at the end ensures that the official, finished version of the document is kept for the correct amount of time, not early drafts.

Feature	Password-based Policy	Certificate-based Policy
How it works	Requires a password to open or change document settings.	Uses a digital certificate for security, often tied to a user's identity.
Ease of use	Easier to set up for individual users or small groups.	More complex setup, usually managed by IT for larger organizations.
Security level	Good for general protection, but passwords can be shared or forgotten.	Stronger security, as certificates are harder to copy or misuse.

Enforce Departmental Retention

When to use it

AI prompts

How to do it

Glossary

The real tasks

Who does this

FAQ

Sources