# Data governance decisions still requiring organisational approval

Two requirements in the original brief were deliberately left configurable instead of being guessed in code.

## Participant data retention

Current implementation:

- `participants.retention_until` stores the record-specific retention date.
- `privacy.default_retention_years` is configurable in site settings.
- No destructive scheduled purge is enabled by default.

Before enabling automated deletion/anonymisation, define the rule with the organisation's DPO/legal/regulatory team and study sponsors. The final policy may differ by jurisdiction, study protocol, consent wording and record type. Once approved, a scheduled anonymisation/purge command can consume `retention_until` without schema changes.

## External analytics

Current implementation:

- operational recruitment analytics are first-party and calculated from CTMS data;
- `analytics.google_analytics_id` exists as an optional setting;
- no external analytics tracker is forced into the public pages.

This avoids transmitting participant/public browsing data to a third party before the organisation chooses a consent/cookie strategy and analytics vendor. A later analytics integration can be enabled conditionally from the setting/environment without changing the core CTMS APIs.