Some reports have expired accordingly to the configured data retention policy. Can the be restored?

[Grorato]

Dear Support Team,
I am writing to request assistance regarding an issue with the whistleblowing system. Once the 90-day period following the submission of a report has elapsed, the report is no longer visible within the channel; however, the recipients need to access it because the case is still ongoing. Could you please provide instructions on how to restore visibility for the missing report, as well as guidance on configuring the platform so that data remains available for the full 5-year period and is not deleted prematurely?
Thank you.
Best Regards

[evilaliv3]

Hello @Grorato

Thank you for your request.
The system implemente secure data retention policies that have a default of 90 days and are fully configurable in the Channel configuration.
When reports are deleted following the policy reports are securely and permanently deleted according to best practices, as GDPR required.
If your users don't see anymore the report it probably means that administrators have decided to maintain the default data retention policy and for this reason reports are expired and permanently deleted. In this condition unfortunately there is no possibility to restore the reports as they do not exist anymore in any form. Let me say that the platform informs recipients of the deletion of reports, with an email sent every day till expiration so probably your recipients have ignored this emails.
To implement a data retention policy of 5 years you just need to change the data retention policy from 90 days to 1825 days.

Let me say that setting a data retention policy of 90 days is incorrect; the European directive set this limit as upper bound; organizations should not maintain the data for more than 5 years but the must as well delete the data as soon that it is not necessary anymore. Preserving ANY data for 5 years would represent a violation of the whistleblowing directive and of the GDPR.
GlobaLeaks is designed to properly configure a default data retention policy (typically set to 90 days that is the timing of handling of reports), and let recipients manually change the date of expiration of reports if a report require to be kept for additional time.