How do administrators set up Enterprise Policy Retention?

First, coordinate with your IT team to design the policy rules. Then, as an account or group admin, go to the retention settings. Define the number of days to keep files (up to 15 years). Choose if the policy uses passwords or certificates for security. Apply these policies to files when they are in their final state.

What compliance standards does Enterprise Policy Retention support?

PCI DSS 3.0 (for credit card data security) HIPAA (for healthcare data privacy) SOC 2 Type II (for service organization controls) ISO 27001 (for information security management)

Defensible Data Retention in Adobe Acrobat — How-to & AI prompts

AI prompts

1 way to ask · copy any one

DBecome — “help me grow”Across our past year's document sharing incidents, which practices caused the most accidental…+

Across our past year's document sharing incidents, which practices caused the most accidental exposure of customer-sensitive data? Show the pattern and recommend a single redaction and retention policy that is practical for field techs and satisfies compliance. Provide a short rollout checklist and the minimal logging the company should keep for audits.

when the reply comes backPush once: ask it to sharpen the weakest part, and to say what it assumed.

How to do it

the tool · the steps · what to avoid

1
Sign in to the Adobe Admin Console with your administrator credentials.
2
Navigate to the Acrobat Sign section within the Admin Console.
3
Select Account Settings and then locate the Retention Policies area.
4
Identify the retention rule currently applied to the documents or user group under legal investigation.
5
Edit the relevant retention rule and set its status to Disabled or Suspended to pause automatic deletion.
CautionDisabling or suspending a retention rule will prevent deletion for all documents governed by that rule until re-enabled.
6
Document the legal hold action, including affected documents and justification, for compliance records.
Best practiceMaintain a separate log of legal holds to ensure you can track and audit overrides to retention policy, as recommended by enterprise admins.
7
Notify relevant stakeholders (e.g., Legal, Compliance) that the retention policy has been suspended for the specified documents.

In the appWith the API

You can review and manage retention rules for user folders directly in the Admin Console to ensure compliance with legal holds.

This runs in the Acrobat app - there is no separate API for this task.

Glossary

words on this page

Retention PolicyA set of rules that decides how long documents are kept and how they are handled.ExampleOur company's retention policy states that all invoices must be kept for seven years.

Terminal StateThe final stage of a document, after which no more changes are expected.ExampleOnce approved and archived, the contract reached its terminal state, meaning no further edits were allowed.

ComplianceFollowing the rules or laws about how something should be done.ExampleEnsuring compliance means all invoices meet the company's financial record-keeping standards.

The real tasks

the one, listed here

The company needs a defensible record-retention practice that keeps customer data out of shared folders.

FAQ

about this task

First, coordinate with your IT team to design the policy rules.
Then, as an account or group admin, go to the retention settings.
Define the number of days to keep files (up to 15 years).
Choose if the policy uses passwords or certificates for security.
Apply these policies to files when they are in their final state.

A 'terminal state' means a document is complete and will not be changed again. Retention policies are applied at this point, so the countdown for how long to keep the file starts when it is finalized, not while it is still being worked on.

Enterprise Policy Retention helps by letting you set specific timeframes for keeping data, like patient records, for as long as HIPAA requires. It ensures that sensitive information is kept securely and deleted only after the required period, helping your company meet its legal obligations for data storage and privacy.

Standardizing file naming is important because it helps retention policies work correctly. When files have clear, consistent names, it's easier for the system to apply the right policy to the right document. This also makes it simpler for people to find and manage files, improving overall organization and compliance.

PCI DSS 3.0 (for credit card data security)
HIPAA (for healthcare data privacy)
SOC 2 Type II (for service organization controls)
ISO 27001 (for information security management)

Defensible Data Retention

When to use it

AI prompts

How to do it

Glossary

The real tasks

Who does this

FAQ

Sources