How do I set up a new retention policy for my department's documents?

First, you need to be an administrator for your account or group. Access the admin guide for Enterprise Acrobat or the security policies section. Create a new reusable policy set, choosing if it's password or certificate-based. Define the retention period, from 1 day up to 15 years, for documents in their final state. Ensure the policy meets relevant compliance standards before saving and applying it.

What is the difference between a password-based and a certificate-based security policy in Acrobat?

Policy Type Security Method Typical Use. Password-based Uses a password to protect documents. Good for simpler, internal sharing where passwords can be managed. Certificate-based Uses digital certificates for stronger encryption and authentication. Better for high-security environments, external sharing, and regulatory compliance.

Retention And Access Risk in Adobe Acrobat — How-to & AI prompts

AI prompts

1 way to ask · copy any one

CDecide — “help me choose”I need to set retention and access controls for archived study reports so only authorized roles…+

I need to set retention and access controls for archived study reports so only authorized roles can retrieve them, but auditors must still be able to access records. I fear overrestriction will cause friction and underrestriction will create exposure. Recommend a retention and role-based access scheme that satisfies audits without blocking research, list one metadata tag that enforces retrieval policies, and a communication line for staff who need exceptions.

when the reply comes backPush once: ask it to sharpen the weakest part, and to say what it assumed.

How to do it

the tool · the steps · what to avoid

1
Sign in to the Adobe Acrobat Sign Admin Console with your administrator credentials.
2
Navigate to the Governance section from the Admin menu.
3
Select the retention rule you want to monitor for compliance.
4
Open the audit logs or report for the selected retention rule.
NoteAudit history is stored for 12 months by default; your organization may have a different retention period.
5
Review the log entries or reports to verify that data deletions are occurring as scheduled according to the retention policy.
6
Export or download the audit report if you need to retain evidence of compliance or share findings with stakeholders.
7
Repeat this process regularly to ensure ongoing retention policy enforcement.
Best practiceConsider automating log reviews with scheduled exports and alerts to streamline compliance monitoring.

In the appWith the API

You can access detailed audit logs for retention events directly in the Data Governance section of the Admin Console.

This runs in the Acrobat app - there is no separate API for this task.

Glossary

words on this page

Retention PolicyA set of rules that decides how long documents are kept and how they are handled.ExampleOur company's retention policy states that all invoices must be kept for seven years.

Terminal StateThe final stage of a document, after which no more changes are expected.ExampleOnce approved and archived, the contract reached its terminal state, meaning no further edits were allowed.

ComplianceFollowing the rules or laws about how something should be done.ExampleEnsuring compliance means all invoices meet the company's financial record-keeping standards.

Who does this

3 roles

Compliance OfficerIT AdministratorRecords Manager

FAQ

about this task

Enterprise Policy Retention is a system that automatically manages how long your company's documents are stored and who can access them. It matters because it helps your company follow important laws and rules, like HIPAA for healthcare data or PCI DSS for payment information, which can prevent legal problems and protect sensitive information.

First, you need to be an administrator for your account or group.
Access the admin guide for Enterprise Acrobat or the security policies section.
Create a new reusable policy set, choosing if it's password or certificate-based.
Define the retention period, from 1 day up to 15 years, for documents in their final state.
Ensure the policy meets relevant compliance standards before saving and applying it.

If your company handles sensitive customer data, Enterprise Policy Retention helps by letting you set strict rules for how long that data is kept and who can see it. For example, you can configure policies that meet HIPAA or ISO 27001 standards, ensuring data is protected and deleted after its required retention period, reducing the risk of data breaches and fines.

Policy Type	Security Method	Typical Use
Password-based	Uses a password to protect documents.	Good for simpler, internal sharing where passwords can be managed.
Certificate-based	Uses digital certificates for stronger encryption and authentication.	Better for high-security environments, external sharing, and regulatory compliance.

Regular users cannot see or change retention settings because these policies are set at an enterprise level by administrators. This ensures that all documents follow company-wide rules for data retention and security, which is important for legal compliance and consistent data management across the organization.

Retention And Access Risk

When to use it

AI prompts

How to do it

Glossary

The real tasks

Who does this

FAQ

Sources