Compliance
Governance that knows which rules apply to you
Most document tools give you a retention dropdown and wish you luck. DocuSanad ships a registry of real regulatory obligations, and evaluates your library against the ones you say apply.
What this is, and what it is not
DocuSanad reports how your content compares with the frameworks you have selected, and gives you the evidence to demonstrate it. It does not make your organisation compliant, and we will never claim it does. Compliance is a property of your processes, not of a document library. Retention periods here are common baselines; real obligations vary by sector, record type, jurisdiction and contract. Every finding carries a citation so your own advisers can check our reasoning.
The registry
Fourteen frameworks, encoded as data
| Framework | Full name | Jurisdiction |
|---|---|---|
| GDPR | General Data Protection Regulation | European Union |
| UK GDPR | UK GDPR and Data Protection Act 2018 | United Kingdom |
| HIPAA | Health Insurance Portability and Accountability Act | United States |
| SOX | Sarbanes-Oxley Act | United States |
| CCPA/CPRA | California Consumer Privacy Act | California |
| PIPEDA | Personal Information Protection and Electronic Documents Act | Canada |
| LGPD | Lei Geral de Proteção de Dados | Brazil |
| POPIA | Protection of Personal Information Act | South Africa |
| PDPA | Personal Data Protection Act | Singapore |
| Privacy Act | Privacy Act and Australian Privacy Principles | Australia |
| DPDP | Digital Personal Data Protection Act | India |
| PDPL | Personal Data Protection Law | Saudi Arabia |
| PDPL | Federal Decree-Law No. 45 of 2021 | United Arab Emirates |
| ISO 27001 | ISO/IEC 27001:2022 | International standard |
Professional includes two frameworks. Enterprise and above include all fourteen.
How it decides
Four rules the engine will not break
Legal hold wins
A document under hold is never proposed for disposition, whatever any retention rule says. Destroying held data is spoliation, not housekeeping — so hold is checked first and short-circuits everything else.
Floors beat ceilings
Where SOX demands seven years and CCPA permits two, the floor wins and the conflict is surfaced for a human. Keeping data too long risks a fine; destroying it too early can be a criminal offence.
Scoped, so it stays quiet
A framework only produces findings for the data classifications it actually governs. A GDPR customer never sees HIPAA noise on an invoice, which is what keeps the findings list worth reading.
Under-classifying is the dangerous direction
When several detectors fire, the most consequential classification wins. Treating health data as ordinary personal data would silently lose its statutory retention floor.
Findings
What it actually flags
| Finding | Severity | Why it matters |
|---|---|---|
| Unclassified document | Medium | Obligations cannot be determined until it is classified |
| No lawful basis recorded | High | Personal data held without a documented Article 6 basis |
| Retention below statutory floor | Critical | Early destruction may itself be an offence |
| Retention above privacy ceiling | Medium | Contrary to the storage limitation principle |
| No data subject recorded | Medium | The document will not surface in an access or erasure request |
| Sensitive data held too openly | High | Special category or PHI below Confidential |
| Disposition overdue | Medium | Retention expired and no hold applies |
| Review overdue | Medium | Periodic review date has passed |
Data subject requests
Find everything about one person
- Search by name or email across the governed library
- Matching is deliberately broad — a reviewer discarding an extra document is recoverable, missing one is a breach
- Each result states whether erasure is permitted, and why not if it is refused
- Legal hold and an unexpired statutory floor are both lawful refusals you can evidence
Disposition, when retention ends
The queue proposes; a human disposes. Outcomes are Destroy, Retain longer, Archive or Defer — and a reason is mandatory on every decision, because producing evidence that a named person made a considered decision is the entire point.
Nothing is ever deleted automatically. An automated delete driven by a rule that turns out to be wrong is unrecoverable, and “the software did it” is not a defence anyone wants to make to a regulator. Even Destroy only recycles the file.
Microsoft Purview
Where Purview is present, Purview wins
Holds are combined
Either system asserting a hold blocks disposition. There is no case where it is right to destroy something because only one of two systems said to keep it.
Schedules are never pre-empted
A labelled document never enters our disposition queue, even if our own retention date has passed.
Disagreements are surfaced
A Purview label plus a DocuSanad retention policy raises a conflict for a records manager. We do not silently pick a winner.
It costs nothing to read
Retention labels ride on ordinary SharePoint fields — no Graph call, no extra permission, no admin consent.