Design a retention policy manager for GDPR Compliance

Design a retention policy manager for GDPR Compliance

Duration : 3 months
Tools used : Figma, UX Pin, Xmind, Confluence

Designing for trust and transparency to simplify retention management and strengthen data governance in regulated environments.

Duration : 3 months
Tools used : Axure, Figma, Xmind, Confluence, Pendo, Google analytics, Optimal workshop

Designing for trust and transparency to simplify retention management and strengthen data governance in regulated environments.

Data transformation from one spreadsheet to another
Data transformation from one spreadsheet to another

My contribution

  • Led UX research and testing

  • Design a scalable retention policy experience

  • Collaborate cross-functionnally with product engineering & compliance

UX KPIs

✔️ Set up retention policies is customized and easy to configure

✔️  Reduced manual effort & decision making

✔️  After few month users felt very confident about the system and its automatic mass deletion

Product design KPIs

✔️ Rolled out in 1year to 100+ customers

✔️ Delivered a new self-service feature to help clients stay compliant with data regulations

✔️ Design for GDPR compliance with a focus on trust, security, and transparency

Collaboration team

Alexandra L.

Product Owner

Thomas L.

Full stack dev.

Fanny G.

Product M.

Nadia F.

Head of Line

Elodie E.

Product M.

Background

As client demand for data retention policies, GDPR compliance, and large-scale data lifecycle management intensified, the business made it a strategic priority to accelerate a beta release that could meet these regulatory and operational needs.

Quick reminder of General Data Protection Regulation stands for GDPR. It mandates the implementation of data retention policies (RP) to ensure compliance with its requirements.

From a product design perspective, the challenge was multifaceted:

  • enable users the creation of flexible retention rules across various the Suite and data types

  • account for complex dependencies—such as nested object hierarchies or data integrity

Given the technical depth and regulatory sensitivity, I worked closely with the Product Owner to scope the initiative and break it down into actionable, research-driven design phases. I led the initial discovery, identifying user pain points, mapping lifecycle scenarios, and aligning closely with engineering to ensure feasibility from day one.

This approach helped us not only define a clear MVP, but also anticipate long-term scalability challenges early in the design process. We delivered the feature in focused batches, enabling us to validate assumptions, gather feedback, and refine the product incrementally. This iterative, insight-driven approach resulted in a robust and intuitive solution that not only met strict compliance requirements but also received highly positive feedback from our customers upon release.

How did we came up with a product roadmap

  1. Understand how users manage retention policies

Based on documentation, interviews with users and PO

Understand how users manage their retention policies was crucial.
• Define was is a retention policy, how it works
• How to technically configure a retention policy across 2 distinct products
• Locate and reviewing detailed information within a specific policy

I formulated 3 key behavioral hypotheses and tested them through 2 scenario-driven usability sessions, capturing both interaction patterns and user expectations.

Insights from these sessions directly informed key design decisions—helping us streamline workflows, surface critical information more intuitively, and reduce cognitive load for HR and compliance users.

  1. How to manage incoming-deleted items

Based on documentation, interviews with users and PO

I began by exploring the “incoming deletion” experience—focusing on how users interact with retention policy items, on their automatic deletion and the manually deleted ones. Key questions guided the discovery phase: What types of items are stored? How long are they retained? Where can users find them? And how easily can they be searched?

To validate the experience, I defined 4 user behavior and feedback hypotheses, which I tested using mid-fidelity monadic interface. This approach allowed me to isolate specific interactions, gather focused insights, and iterate quickly based on user feedback.

Assumptions and feedback

Retention policy manager

Retention policy manager

Retention policy manager

User tests

User tests - hypothesis

🫥 User founds the dedicated RP by its name
—> expert users also search by UUIDs or trigger dates

✅ User goes along all the step as checkup before editing

✅ User understand the creation/edition workflow
🫥 User founds the dedicated RP by its name
—> expert users also search by UUIDs or trigger dates

✅ User goes along all the step as checkup before editing

✅ User understand the creation/edition workflow

Incoming permanent deletion items

Monadic tests

Monadic tests - hypothesis

🫥 User delete in mass the item deleted in the next 4 days by prevention —> The habit fades as the trust grows

🫥 User verify the origin of deletion before confirming mass deletion. —> Users will focus on what is being deleted.

✅ User will restore only items deleted by someone in the team because of an error

✅ User expect this trash in only one place: with RP

  1. Additional impactful insights

From tech teams and in pair with PO

  • Get all the info and data we collect from end users in each product

  • Users need a centralized view of data to ensure transparency and confidently validate mass deletions.

  • Users primarily search within the “soon-to-be-deleted” list to identify and restore items before permanent deletion—>highlighting the importance of clear visibility and efficient recovery workflows.



  • When an RP changes, users are currently required to manually update each associated document individually
    —> highlighting a major inefficiency and risk of inconsistency.

  • In-app notifications are essential to alert stakeholders when a retention policy is updated or impacts existing items.

  • RP tend to be stable over time, so designing for rare but high-impact updates became a key design consideration.

Deliverables

Product roadmap
Results page

What we observed after 6months ?

Background

1year

to roll out all interested customers

30%

improve task success via testing

Impact we made

Background
Background

1 year

to roll out all interested customers

1 year

to roll out all interested customers

30%

improve task success via testing

30%

improve task success via testing

Final reflections

This project was a meaningful opportunity to turn a strict regulatory need into a clear, user-centered experience. By combining legal compliance with thoughtful UX, we enabled users to confidently manage complex data lifecycles.

What started as a high-risk, complex initiative evolved into a scalable, reliable solution embraced by both technical and non-technical users.