Retention Lock on Dell PowerProtect Data Domain prevents protected backup data from being changed or deleted before its retention expires. It comes in two modes, and the difference is important.
Governance mode
Protects data from change, but authorized administrators can revert the lock in controlled circumstances. It suits operational protection where flexibility is needed.
Compliance mode
Applies stricter controls designed to meet regulatory retention requirements — locks cannot be shortened and additional security-officer authorization is required for sensitive operations.
How to choose
- Use compliance mode for regulated or last-resort copies.
- Plan retention carefully — strict locks cannot be undone.
- Protect the system clock and security-officer credentials.
- Document the configuration for auditors.
Operational considerations
Retention Lock protects data, but it also affects capacity planning: locked data cannot be deleted early to reclaim space. Size the system with retention periods in mind and monitor growth closely.
Document who holds security-officer credentials, how they are protected and how changes are approved. Include Retention Lock settings in regular configuration reviews so a well-intentioned change does not weaken protection without anyone noticing.
Key takeaways
- Governance mode is flexible; compliance mode is strict.
- Strict locks need careful retention planning.
- Protect the credentials and clock that underpin the lock.
Want an independent view of your recoverability?
Book a Recovery Readiness Call and we’ll help you turn assumptions into evidence.
