Automatically manage how long agreements and related data are retained in Adobe Acrobat Sign using configurable retention policies.
Data governance in Adobe Acrobat Sign allows administrators to automatically delete agreements and associated data from the Acrobat Sign systems after a defined retention period. This helps organizations reduce stored data, meet compliance requirements, and manage agreement lifecycle without manual cleanup.
Data governance acts as a delayed trigger that begins only after an agreement reaches its final system state.
Retention policies are applied after an agreement reaches a terminal state, such as when it is completed, canceled, or expired. Once triggered, the policy defines how long the agreement and related data are retained before permanent deletion.
By default, agreements and transaction data are retained in Acrobat Sign while the account is active unless they are manually deleted or governed by a retention rule.
How data governance works
Data governance follows a trigger-based model:
- Agreements reach a terminal state when Acrobat Sign records the agreement as Completed, Canceled, or Expired.
- A retention rule is applied when Acrobat Sign records the agreement in a terminal state.
- The rule defines how long the agreement and associated data are retained before deletion.
- Only one retention rule is active at a time for newly terminal agreements. When a new rule is created, it becomes the active rule and applies to all agreements that achieve a terminal state in the future. Previously active rules continue to apply to agreements that were already assigned to them and don't need to be disabled.
Retention rules are adopted from the primary group the sending user belongs to at the time the agreement reaches its terminal state. If the user changes primary groups before the agreement completes, the new group's retention rules apply.
Retention periods are applied based on the configured duration from the time the agreement is recorded in a terminal state. Because terminal-state processing may be delayed by up to 12 hours, the start of the retention period may be delayed as well.
How terminal state timing affects data governance
Data governance policies begin only after an agreement reaches a terminal state, such as Completed, Canceled, or Expired.
To optimize system performance, Acrobat Sign processes terminal-state events during off-peak hours, based on the server that handled the agreement. Off-peak hours are 7 PM to 7 AM in the server’s local time zone.
If an agreement reaches a terminal condition during peak hours, the event is queued and processed during the next off-peak window. This may delay the final status update by up to 12 hours.
During this processing window:
- The agreement remains in its previous state, In Progress, in both the Manage page and API responses.
- Recipients can no longer sign the agreement and receive an error if they attempt to access it.
- For agreements pending expiration, senders can update the expiration date during this window to extend the signing period.
- The terminal event isn't recorded in the audit report until processing is complete.
Because data governance policies are triggered only after the agreement reaches its final state, any delay in processing also delays the start of the retention period.
How it’s used
Organizations use data governance to:
- Automatically delete completed or inactive agreements after a defined period.
- Reduce the amount of stored agreement data.
- Align document retention with internal compliance policies.
- Manage data lifecycle without manual intervention.
If no retention rule is defined when an agreement reaches a terminal state, no deletion date is assigned. Agreements remain in the system until they are manually deleted or removed via GDPR tools.
What can be deleted
Retention rules define which data is deleted when the rule is executed:
- The agreement document.
- The audit report.
- Associated personal data collected during the transaction.
- Agreements that use an authentication method that produces a Signer Identity Report, that report is deleted as part of personal data.
Audit and personal data must be retained for at least as long as the agreement and can be configured to persist longer if needed.
Things to know
- Retention rules are applied when an agreement reaches a terminal state, not when it is created.
- Only one retention rule is applied to an agreement at the time it becomes terminal.
- Retention rules are based on the group the sending user belongs to at the time the agreement reaches its terminal state.
- If the user changes groups before the agreement completes, the new group’s rules apply.
- Terminal-state processing may be delayed by up to 12 hours during peak times, delaying the start of retention policies.
- If no retention rule is defined, agreements are retained until manually deleted or removed through other processes.
