An investigation accumulates the most sensitive category of material an organisation can hold: information about identifiable people, gathered without their involvement, often about allegations that may turn out to be wrong.
Two disciplines keep that from becoming a liability. Provenance — knowing where each item came from. Retention — knowing how long it may stay.
Provenance: the answer to "how do you know that?"
Provenance is the record that connects a statement in a report to the material behind it: the source as consulted, the date, and the decision that admitted it.
Without it, a report is an assertion. With it, the report can be checked by a reviewer, a client, a regulator or opposing counsel — which is the only condition under which investigative findings are worth anything.
Practically, that means keeping the source as it was seen rather than a link that may change, recording when it was consulted, and keeping the admission decision alongside the item. See the Archive.
Retention: everything expires
Personal data is held for a purpose and for a period. When the purpose ends, the data should go — including the copies that accumulate in exports, working folders and someone's downloads directory.
Three habits make this survivable:
Collect narrowly. The cheapest data to delete is the data you never gathered. Scope limits the collection, not the other way round.
Define the clock at the start. Retention that is decided at the end is retention that never happens. Write it into the case when the case opens.
Make deletion real. A case removed from a dashboard while copies persist in three other systems has not been deleted. This is one of the strongest arguments for keeping the case file on the analyst's own machine — see device zero.
People have rights over this material
Subjects may have rights of access, correction and erasure depending on jurisdiction and on the lawful basis being relied on, and investigative exemptions are narrower than people assume. An organisation that cannot say what it holds about someone cannot answer such a request at all — and provenance is what makes that answer possible.
None of this is legal advice. Your obligations depend on your jurisdiction, your role and your engagement; take advice for those.
Wrong conclusions have consequences
The reason to be strict is not paperwork. Investigative errors land on real people: the wrong person named, an allegation attached to someone who shares a surname, a finding that outlives the correction. Provenance is how errors get caught; retention is how they stop propagating. See the homonym problem.
Frequently asked questions
How long should a case be kept? For as long as the purpose requires, under the policy you set and the obligations you are subject to. The point is that the answer exists and is enforced.
Does provenance mean keeping everything? No. It means what you keep can be traced. Narrow collection and strong provenance work together.
What about material that was rejected? It stays in the case as rejected while the case lives, then follows the same retention rule.
Read next: accepted and rejected evidence or device zero.