Data Retention & Compliance

Overview

This document defines the data retention policies, backup procedures, privacy requirements, and compliance obligations for the Lofty Golden Oil ERP system. These policies are designed to meet Nigerian business compliance requirements including tax law, corporate regulations, and the Nigerian Data Protection Regulation (NDPR) 2019.

Applicable Regulations:

Nigerian Companies and Allied Matters Act (CAMA)
Nigerian Tax Laws (Companies Income Tax Act, Value Added Tax Act)
Nigerian Data Protection Regulation (NDPR) 2019
Financial Reporting Council of Nigeria (FRCN) requirements

Data Retention Policy

Financial Records

Scope: Sales transactions, invoices, payments, expenses, general ledger entries, journal entries, payment vouchers, trial balance reports, profit and loss statements, balance sheets.

Data Type	Minimum Retention	Justification
Sales records	7 years	Nigerian Companies Income Tax Act
Invoices (AR)	7 years	Tax audit trail requirements
Payments received	7 years	Financial reconciliation records
Expenses	7 years	Tax deduction substantiation
General Ledger entries	7 years	Statutory financial records
Journal entries	7 years	Audit trail for financial statements
Payment vouchers	7 years	Disbursement authorization records
Tax-related records	7 years	FIRS audit requirements

Implementation:

Financial records in MySQL are never deleted from the database.
A scheduled job can archive records older than 7 years to cold storage (recommended).
Database backups preserve all historical data.

Audit Logs

Scope: All entries in the audit_log table including user actions, CRUD operations, login events, approvals, rejections, and IP addresses.

Data Type	Retention Period	Justification
System audit logs	Indefinite	Never delete — required for compliance, forensics, and dispute resolution

Implementation:

The audit_log table has no DELETE endpoint.
No application code removes audit log entries.
Backups preserve all audit history.
If the table grows beyond reasonable size, archive old entries to cold storage — never delete.

User Records

Scope: Employee and system user accounts including name, email, role, status, and activity history.

Data Type	Retention Period	Justification
Active user profiles	Duration of employment + 7 years	Employment records retention
User role history	Duration of employment + 7 years	Access control audit trail
User login history	2 years	Security monitoring
Inactive accounts	7 years after deactivation	Employment record compliance

Implementation:

User accounts are deactivated (status set to inactive), never deleted, when employees leave.
The users table retains all historical records.
Personal data of former employees is retained solely for compliance purposes.

Inventory Records

Scope: Inventory items, stock levels, stock adjustments, and historical cost data.

Data Type	Retention Period	Justification
Inventory master data	5 years after last transaction	Product lifecycle tracking
Stock levels (point-in-time)	5 years	Operational history
Inventory adjustments	5 years	Loss prevention and audit
SKU history	5 years	Product identification continuity

Implementation:

Inventory items are marked as Inactive rather than deleted when no longer stocked.
All stock transactions (purchases, sales, adjustments) are permanently recorded.
Historical cost data supports financial reporting and tax compliance.

Customer and Supplier Records

Scope: Customer and supplier profiles, contact information, and transaction history.

Data Type	Retention Period	Justification
Customer profiles	7 years after last transaction	Business relationship records
Customer credit history	7 years	Credit risk assessment history
Supplier profiles	7 years after last transaction	Procurement audit trail
Customer/supplier contact data	7 years	Communication records for disputes

Implementation:

Customer and supplier records are marked Inactive rather than deleted.
Transaction history (sales, purchases, invoices, payments) is permanently retained.
Personal contact data (names, phone numbers, emails) is retained only as long as legally required.

Production Records

Scope: Production runs, batch records, input/output volumes, yield calculations, and cost data.

Data Type	Retention Period	Justification
Production run records	5 years	Manufacturing quality and cost tracking
Batch information	5 years	Traceability for product quality
Yield calculations	5 years	Operational efficiency analysis
Cost per litre data	5 years	Pricing and profitability analysis

Implementation:

Production records are permanently retained in the database.
No deletion mechanism exists for production runs.
Data supports historical trend analysis and regulatory compliance.

Requisition Records

Scope: All requisition records including the complete approval workflow with notes and timestamps.

Data Type	Retention Period	Justification
Requisition records	7 years	Expenditure authorization documentation
Approval workflow history	7 years	Internal control compliance
Supervisor/manager notes	7 years	Decision-making audit trail
Rejection records	7 years	Governance and accountability

Implementation:

Requisition records are never deleted.
The full approval chain (who approved, when, with what notes) is permanently retained.
This data supports internal and external audit of expenditure controls.

Data Backup Policy

Backup Schedule

Backup Type	Frequency	Retention	Description
Full database backup	Daily at 02:00 WAT	30 days	Complete dump of `lgo_erp_prod`
Staging database backup	Weekly (Sunday 03:00 WAT)	30 days	Complete dump of `lgo_erp_staging`
Monthly archive	1st of each month	12 months	Full backup archived separately
Pre-deployment backup	Before each deployment	Until next backup	Safety net for CI/CD changes

Backup Locations

Location	Type	Purpose
VPS local (`/var/backups/lgo-erp/`)	Primary	Fast restoration
Offsite (recommended)	Secondary	Disaster recovery

Recommended Offsite Options:

Oracle Cloud Object Storage (same region, low latency)
AWS S3 with lifecycle policies
Encrypted backup to a secondary VPS

Backup Commands

# Daily backup of production database
mysqldump -u lgo -p"$DB_PASSWORD" lgo_erp_prod | gzip > /var/backups/lgo-erp/prod_$(date +%Y%m%d).sql.gz

# Cleanup: remove backups older than 30 days
find /var/backups/lgo-erp/ -name "prod_*.sql.gz" -mtime +30 -delete

# Monthly archive (1st of month, keep 12 months)
cp /var/backups/lgo-erp/prod_$(date +%Y%m%d).sql.gz /var/backups/lgo-erp/monthly/
find /var/backups/lgo-erp/monthly/ -name "prod_*.sql.gz" -mtime +365 -delete

Backup Verification

Check	Frequency	Method
Backup file exists	Daily	Automated script
Backup file is non-empty	Daily	Automated script
Backup file integrity (gzip test)	Daily	Automated script
Restoration test	Monthly	Manual restore to staging VPS
Full disaster recovery drill	Quarterly	Manual restore to new VPS

Restoration Procedure

# 1. Stop the application
pm2 stop lgo-prod

# 2. Create a pre-restoration backup
mysqldump -u lgo -p lgo_erp_prod > /var/backups/lgo-erp/pre_restore.sql

# 3. Restore the database
mysql -u lgo -p lgo_erp_prod < /var/backups/lgo-erp/prod_YYYYMMDD.sql

# 4. Verify data integrity
mysql -u lgo -p -e "SELECT COUNT(*) FROM lgo_erp_prod.sales;" 

# 5. Restart the application
pm2 start lgo-prod

Data Deletion Procedures

Soft Delete (Preferred)

Business records should use soft delete — setting a status field to indicate deletion without removing the record:

Entity	Soft Delete Method
Users	Set `status` to `inactive`
Customers	Set `status` to `Inactive`
Suppliers	Set `status` to `Inactive`
Inventory items	Set `status` to `Inactive`
Sales	Set `status` to `cancelled`
Expenses	Set `status` to `rejected`
Requisitions	Set `status` to `rejected`

Hard Delete (Restricted)

Hard delete (permanent record removal) should only be used for:

Test data created during development
Duplicate records created in error (with admin approval)
Data explicitly requested for deletion under NDPR (subject to legal review)

Hard Delete Rules:

Requires admin approval
Must be logged in the audit log before deletion
Must not violate foreign key constraints (RESTRICT on most FK relationships)
Financial records must never be hard-deleted

Cascading Deletes

Foreign key cascading is configured conservatively:

Relationship	On Delete	Rationale
purchases → inventory	RESTRICT	Cannot delete inventory with purchase history
sales → customers	RESTRICT	Cannot delete customers with sales history
sales → inventory	RESTRICT	Cannot delete inventory with sales history
ar_invoices → sales	RESTRICT	Cannot delete sales with invoices
ar_payments → ar_invoices	RESTRICT	Cannot delete invoices with payments
requisitions → users (requested_by)	RESTRICT	Cannot delete users who created requisitions
requisitions → users (approvers)	SET NULL	If an approver is deleted, preserve the requisition
inventory_adjustments → users	RESTRICT	Cannot delete users who made adjustments
audit_log → users	RESTRICT	Cannot delete users with audit history

User Deactivation vs Deletion

Action	When to Use	Process
Deactivation	Employee leaves the company	Set `status` to `inactive`, reassign pending work, review audit log
Deletion	Test accounts, erroneous creation only	Admin approval required, ensure no dependent records

Deactivation Checklist:

Set user status to inactive immediately
Review recent audit log entries for the user
Reassign any pending requisitions awaiting their approval
Change any shared passwords they had access to
Document the reason for deactivation in the user's notes field
Retain the record for 7 years per retention policy

Privacy Considerations

Personal Data Inventory

Data Category	Data Elements	Source	Retention
Employee data	Name, email, role	User registration	Employment + 7 years
Customer data	Name, company, phone, email, address	Customer onboarding	7 years after last transaction
Supplier data	Name, company, phone, email, address	Supplier onboarding	7 years after last transaction
Transaction data	Sales, purchases, payments	Business operations	7 years
Usage data	IP addresses, login timestamps	Audit log	Indefinite

Nigerian Data Protection Regulation (NDPR) 2019 Compliance

Requirement	Implementation
Lawful basis	All data collected for legitimate business purposes (contractual necessity)
Purpose limitation	Data used only for ERP business functions — not repurposed
Data minimization	Only necessary fields are collected and stored
Accuracy	Users can update their own records; admin manages others
Storage limitation	Retention policies defined per data category (see above)
Integrity and confidentiality	bcrypt passwords, parameterized queries, audit logging, TLS encryption
Accountability	Audit trail tracks all data access and modifications

Employees: Consent obtained through employment contract (legitimate interest basis).
Customers: Consent obtained during business relationship establishment. Privacy notice provided.
Suppliers: Consent obtained through vendor registration process.
Marketing: If email marketing is added, explicit opt-in consent is required per NDPR.

Data Access Requests

Individuals have the right to request access to their personal data. The process:

Request received: Individual submits a written request specifying the data they want to access.
Identity verification: Verify the requester's identity before releasing data.
Data compilation: Extract all personal data held about the individual from relevant tables.
Response: Provide the data within 30 days (NDPR requirement).
Documentation: Log the request and response in the audit trail.

Data sources to check for any individual:

users table (for employees)
customers table (for customers)
suppliers table (for suppliers)
sales table (customer transactions)
ar_invoices table (financial records)
ar_payments table (payment records)
audit_log table (activity history, filtered by user)

Data Portability

If requested, personal data can be exported in a machine-readable format (CSV or JSON). The system supports:

Customer data export via API (GET /api/customers/:id/statement)
Sales history export via API (GET /api/reports/consolidated)
Audit log export via API (GET /api/activity)

Data Classification

Classification	Examples	Access Level	Protection
Public	Company name, product catalog, public website	Anyone	Standard web security
Internal	Operational data, inventory levels, production schedules	Authenticated users (role-based)	JWT authentication, RBAC
Confidential	Financial records, GL entries, P&L, balance sheet, customer balances	Accountant, Admin	Role-based restriction, audit logging
Restricted	User passwords (bcrypt hashes), API keys, JWT secrets, SSH keys, database credentials	System only	Environment variables, file permissions, encryption at rest

Handling Rules

Classification	Storage	Transmission	Disposal
Public	Any	Any	Delete when obsolete
Internal	Encrypted database	HTTPS/TLS	Soft delete, retain per policy
Confidential	Encrypted database	HTTPS/TLS	Soft delete, retain 7 years minimum
Restricted	Encrypted/hashed, env vars	HTTPS/TLS only	Secure overwrite, log the action

Incident Response

Data Breach Notification

Under the NDPR 2019, data breaches must be reported to the Nigerian Data Protection Commission (NDPC) within 72 hours of discovery.

Incident Response Steps

┌─────────────────────────────────────────────────────────┐
│ 1. DETECT                                               │
│    - Monitor audit logs for anomalies                   │
│    - Review system alerts and error logs                │
│    - User reports of suspicious activity                │
├─────────────────────────────────────────────────────────┤
│ 2. CONTAIN                                              │
│    - Isolate affected systems                           │
│    - Revoke compromised credentials immediately         │
│    - Block suspicious IP addresses                      │
│    - Preserve evidence (logs, snapshots)                │
├─────────────────────────────────────────────────────────┤
│ 3. ASSESS                                               │
│    - Determine scope of the breach                      │
│    - Identify what data was exposed                     │
│    - Identify affected individuals                      │
│    - Determine root cause                               │
├─────────────────────────────────────────────────────────┤
│ 4. NOTIFY                                               │
│    - Notify NDPC within 72 hours (if personal data)     │
│    - Notify affected individuals                        │
│    - Notify company management                          │
│    - Engage legal counsel if needed                     │
├─────────────────────────────────────────────────────────┤
│ 5. REMEDIATE                                            │
│    - Patch the vulnerability                            │
│    - Rotate all affected credentials                    │
│    - Update security configurations                     │
│    - Restore data from clean backups if needed          │
├─────────────────────────────────────────────────────────┤
│ 6. DOCUMENT                                             │
│    - Document the incident timeline                     │
│    - Record all actions taken                           │
│    - Create a post-incident report                      │
│    - Implement preventive measures                      │
└─────────────────────────────────────────────────────────┘

Documentation Requirements

Every incident must be documented with:

Date and time of discovery
Description of the incident
Data and systems affected
Root cause analysis
Actions taken to contain and remediate
Notifications sent (to whom, when, what)
Preventive measures implemented
Sign-off by management

Breach Severity Levels

Level	Description	Response Time	Example
Critical	Active data exfiltration, system compromise	Immediate (within 1 hour)	Unauthorized admin access, database exposure
High	Confirmed breach, limited scope	Within 4 hours	Single user account compromise, credential leak
Medium	Suspected breach, unconfirmed	Within 24 hours	Suspicious login attempts, unusual data access
Low	Security event, no breach confirmed	Within 72 hours	Failed login attempts, port scanning

Policy Review and Updates

Review Type	Frequency	Responsible
Full policy review	Annually	Management + IT
Backup restoration test	Monthly	IT
Retention policy audit	Quarterly	Compliance
Incident response drill	Semi-annually	IT + Management
Access control review	Monthly	Admin

Last Reviewed: July 2026 Next Review: July 2027 Document Owner: Lofty Golden Oil Ltd — IT / Compliance

Overview​

Data Retention Policy​

Financial Records​

Audit Logs​

User Records​

Inventory Records​

Customer and Supplier Records​

Production Records​

Requisition Records​

Data Backup Policy​

Backup Schedule​

Backup Locations​

Backup Commands​

Backup Verification​

Restoration Procedure​

Data Deletion Procedures​

Soft Delete (Preferred)​

Hard Delete (Restricted)​

Cascading Deletes​

User Deactivation vs Deletion​

Privacy Considerations​

Personal Data Inventory​

Nigerian Data Protection Regulation (NDPR) 2019 Compliance​

Consent Requirements​

Data Access Requests​

Data Portability​

Data Classification​

Handling Rules​

Incident Response​

Data Breach Notification​

Incident Response Steps​

Documentation Requirements​

Breach Severity Levels​

Policy Review and Updates​

Overview

Data Retention Policy

Financial Records

Audit Logs

User Records

Inventory Records

Customer and Supplier Records

Production Records

Requisition Records

Data Backup Policy

Backup Schedule

Backup Locations

Backup Commands

Backup Verification

Restoration Procedure

Data Deletion Procedures

Soft Delete (Preferred)

Hard Delete (Restricted)

Cascading Deletes

User Deactivation vs Deletion

Privacy Considerations

Personal Data Inventory

Nigerian Data Protection Regulation (NDPR) 2019 Compliance

Consent Requirements

Data Access Requests

Data Portability

Data Classification

Handling Rules

Incident Response

Data Breach Notification

Incident Response Steps

Documentation Requirements

Breach Severity Levels

Policy Review and Updates