Biometric templates stored with no retention limit or destruction path

Store each face or voice template with its purpose and an expiry, and run a scheduled job that deletes it from every store when the purpose ends or retention lapses.

Each template row or collection entry carries its purpose, last_interaction_at, and an expires_at computed from the written retention schedule. A scheduled deletion job (cron, Celery beat, EventBridge schedule) removes expired templates from every place they live, including the Rekognition collection (delete_faces with the FaceIds) and any vector index, and account closure or the end of the purpose triggers deletion right away. The retention schedule is published (privacy policy or biometric policy page in the site source) and kept in the repo so code and policy match; deletions are logged.

Where it goes: 1 application source code, 2 data models, 4 infrastructure-as-code, 14 user-facing text.

What reviewers look for: an expires_at or TTL on the template store; a deletion job calling delete_faces, a vector-store delete, or a purge that actually runs on a schedule and on account closure; a public biometric retention policy in the site source; deletion logs. A template write with no expiry and no delete path anywhere in the module is the failure.

resp = rekognition.index_faces(CollectionId='members', Image={'Bytes': img}, ExternalImageId=user_id)
db.faces.insert(user_id=user_id, face_id=resp['FaceRecords'][0]['Face']['FaceId'])

resp = rekognition.index_faces(CollectionId='members', Image={'Bytes': img}, ExternalImageId=user_id)
db.faces.insert(user_id=user_id, face_id=resp['FaceRecords'][0]['Face']['FaceId'],
                purpose='door_access', expires_at=retention.expiry_for('door_access', now()))

def purge_expired_faces():   # scheduled daily
    expired = db.faces.expired(before=now())
    for batch in chunks(expired, 1000):
        rekognition.delete_faces(CollectionId='members', FaceIds=[f.face_id for f in batch])
        db.faces.delete_ids([f.id for f in batch])
        deletion_log.record(len(batch), reason='retention_expired')

Engineering guidance, not legal advice. Each provision below may add its own details (a cadence, a deadline, a required notice element): open it for those.