# Data room GDPR compliance: Data Room Compliance Rules > The Data Room Compliance Rules carries 23 published figures read from 2 sources' own pages; the 22 published figures given by regime run from 3 to 6 year, read 7 November 2026. Virtual Data Room Compare · https://virtualdataroomcompare.com/datasets/data-room-compliance-rules/ · computed 2026-11-08 **Range by regime:** 3 to 6 year (range 3 to 6 year; 3 published figures; 2 of 6 sources read publish one). 2 of the 6 named sources read in full publish a figure; 4 publish none, read 7 November 2026. ## By regime and technical control | Breakdown | Median | Range | Sources | |---|---|---|---| | regime SEC Rule 17a-4 | 3 year | 3 to 3 year | 1 | | regime SEC Rule 17a-4 | 18 month | 18 to 18 month | 1 | | regime HIPAA Security Rule | 6 year | 6 to 6 year | 1 | | technical control data residency | 2 year | 2 to 2 year | 1 | ## Every figure, with its source One row per source: the figure the source's own page publishes, the page, and the day it was read. | Source | Figure | Breakdown | Read | |---|---|---|---| | [eCFR, 17 CFR 240.17a-4 (records to be preserved by brokers and dealers)](https://www.ecfr.gov/current/title-17/chapter-II/part-240/subject-group-ECFR17722751b422db3/section-240.17a-4) | 18 month | SEC Rule 17a-4 | 2026-11-03 | | [eCFR, 17 CFR 240.17a-4 (records to be preserved by brokers and dealers)](https://www.ecfr.gov/current/title-17/chapter-II/part-240/subject-group-ECFR17722751b422db3/section-240.17a-4) | 6 year | SEC Rule 17a-4 | 2026-11-03 | | [eCFR, 17 CFR 240.17a-4 (records to be preserved by brokers and dealers)](https://www.ecfr.gov/current/title-17/chapter-II/part-240/subject-group-ECFR17722751b422db3/section-240.17a-4) | 6 year | SEC Rule 17a-4 | 2026-11-03 | | [eCFR, 17 CFR 240.17a-4 (records to be preserved by brokers and dealers)](https://www.ecfr.gov/current/title-17/chapter-II/part-240/subject-group-ECFR17722751b422db3/section-240.17a-4) | 6 year | SEC Rule 17a-4 | 2026-11-03 | | [eCFR, 17 CFR 240.17a-4 (records to be preserved by brokers and dealers)](https://www.ecfr.gov/current/title-17/chapter-II/part-240/subject-group-ECFR17722751b422db3/section-240.17a-4) | 6 year | SEC Rule 17a-4 | 2026-11-03 | | [eCFR, 45 CFR part 164 subpart C (HIPAA Security Rule)](https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-C) | 6 year | HIPAA Security Rule | 2026-11-07 | | [eCFR, 17 CFR 240.17a-4 (records to be preserved by brokers and dealers)](https://www.ecfr.gov/current/title-17/chapter-II/part-240/subject-group-ECFR17722751b422db3/section-240.17a-4) | 3 year | SEC Rule 17a-4 | 2026-11-03 | | [eCFR, 17 CFR 240.17a-4 (records to be preserved by brokers and dealers)](https://www.ecfr.gov/current/title-17/chapter-II/part-240/subject-group-ECFR17722751b422db3/section-240.17a-4) | 3 year | SEC Rule 17a-4 | 2026-11-03 | | [eCFR, 17 CFR 240.17a-4 (records to be preserved by brokers and dealers)](https://www.ecfr.gov/current/title-17/chapter-II/part-240/subject-group-ECFR17722751b422db3/section-240.17a-4) | 3 year | SEC Rule 17a-4 | 2026-11-03 | | [eCFR, 17 CFR 240.17a-4 (records to be preserved by brokers and dealers)](https://www.ecfr.gov/current/title-17/chapter-II/part-240/subject-group-ECFR17722751b422db3/section-240.17a-4) | 3 year | SEC Rule 17a-4 | 2026-11-03 | | [eCFR, 17 CFR 240.17a-4 (records to be preserved by brokers and dealers)](https://www.ecfr.gov/current/title-17/chapter-II/part-240/subject-group-ECFR17722751b422db3/section-240.17a-4) | 3 year | SEC Rule 17a-4 | 2026-11-03 | | [eCFR, 17 CFR 240.17a-4 (records to be preserved by brokers and dealers)](https://www.ecfr.gov/current/title-17/chapter-II/part-240/subject-group-ECFR17722751b422db3/section-240.17a-4) | 3 year | SEC Rule 17a-4 | 2026-11-03 | | [eCFR, 17 CFR 240.17a-4 (records to be preserved by brokers and dealers)](https://www.ecfr.gov/current/title-17/chapter-II/part-240/subject-group-ECFR17722751b422db3/section-240.17a-4) | 3 year | SEC Rule 17a-4 | 2026-11-03 | | [eCFR, 17 CFR 240.17a-4 (records to be preserved by brokers and dealers)](https://www.ecfr.gov/current/title-17/chapter-II/part-240/subject-group-ECFR17722751b422db3/section-240.17a-4) | 3 year | SEC Rule 17a-4 | 2026-11-03 | | [eCFR, 17 CFR 240.17a-4 (records to be preserved by brokers and dealers)](https://www.ecfr.gov/current/title-17/chapter-II/part-240/subject-group-ECFR17722751b422db3/section-240.17a-4) | 3 year | SEC Rule 17a-4 | 2026-11-03 | | [eCFR, 17 CFR 240.17a-4 (records to be preserved by brokers and dealers)](https://www.ecfr.gov/current/title-17/chapter-II/part-240/subject-group-ECFR17722751b422db3/section-240.17a-4) | 3 year | SEC Rule 17a-4 | 2026-11-03 | | [eCFR, 17 CFR 240.17a-4 (records to be preserved by brokers and dealers)](https://www.ecfr.gov/current/title-17/chapter-II/part-240/subject-group-ECFR17722751b422db3/section-240.17a-4) | 3 year | SEC Rule 17a-4 | 2026-11-03 | | [eCFR, 17 CFR 240.17a-4 (records to be preserved by brokers and dealers)](https://www.ecfr.gov/current/title-17/chapter-II/part-240/subject-group-ECFR17722751b422db3/section-240.17a-4) | 3 year | SEC Rule 17a-4 | 2026-11-03 | | [eCFR, 17 CFR 240.17a-4 (records to be preserved by brokers and dealers)](https://www.ecfr.gov/current/title-17/chapter-II/part-240/subject-group-ECFR17722751b422db3/section-240.17a-4) | 3 year | SEC Rule 17a-4 | 2026-11-03 | | [eCFR, 17 CFR 240.17a-4 (records to be preserved by brokers and dealers)](https://www.ecfr.gov/current/title-17/chapter-II/part-240/subject-group-ECFR17722751b422db3/section-240.17a-4) | 3 year | SEC Rule 17a-4 | 2026-11-03 | | [eCFR, 17 CFR 240.17a-4 (records to be preserved by brokers and dealers)](https://www.ecfr.gov/current/title-17/chapter-II/part-240/subject-group-ECFR17722751b422db3/section-240.17a-4) | 3 year | SEC Rule 17a-4 | 2026-11-03 | | [eCFR, 17 CFR 240.17a-4 (records to be preserved by brokers and dealers)](https://www.ecfr.gov/current/title-17/chapter-II/part-240/subject-group-ECFR17722751b422db3/section-240.17a-4) | 3 year | SEC Rule 17a-4 | 2026-11-03 | | [eCFR, 17 CFR 240.17a-4 (records to be preserved by brokers and dealers)](https://www.ecfr.gov/current/title-17/chapter-II/part-240/subject-group-ECFR17722751b422db3/section-240.17a-4) | 3 year | SEC Rule 17a-4 | 2026-11-03 | | [eCFR, 17 CFR 240.17a-4 (records to be preserved by brokers and dealers)](https://www.ecfr.gov/current/title-17/chapter-II/part-240/subject-group-ECFR17722751b422db3/section-240.17a-4) | 2 year | data residency | 2026-11-03 | ## The sentence each figure was read from (24) - [eCFR, 17 CFR 240.17a-4 (records to be preserved by brokers and dealers)](https://www.ecfr.gov/current/title-17/chapter-II/part-240/subject-group-ECFR17722751b422db3/section-240.17a-4), read 2026-11-03: "(8) All reports produced to review for unusual activity in customer accounts until eighteen months after the date the report was generated." - [eCFR, 17 CFR 240.17a-4 (records to be preserved by brokers and dealers)](https://www.ecfr.gov/current/title-17/chapter-II/part-240/subject-group-ECFR17722751b422db3/section-240.17a-4), read 2026-11-03: "(a) Every member, broker or dealer subject to § 240.17a-3 must preserve for a period of not less than 6 years, the first two years in an easily accessible place, all records required to be made pursuant to § 240.17a-3(a)(1) through (3), (5), and (21) and (22), and analogous records created pursuant to § 240.17a-3(e)." - [eCFR, 17 CFR 240.17a-4 (records to be preserved by brokers and dealers)](https://www.ecfr.gov/current/title-17/chapter-II/part-240/subject-group-ECFR17722751b422db3/section-240.17a-4), read 2026-11-03: "(c) Every member, broker or dealer subject to § 240.17a-3 must preserve for a period of not less than six years after the closing of any customer's account any account cards or records which relate to the terms and conditions with respect to the opening and maintenance of the account." - [eCFR, 17 CFR 240.17a-4 (records to be preserved by brokers and dealers)](https://www.ecfr.gov/current/title-17/chapter-II/part-240/subject-group-ECFR17722751b422db3/section-240.17a-4), read 2026-11-03: "(5) All account record information required pursuant to § 240.17a-3(a)(17) and all records required pursuant to § 240.17a-3(a)(35), in each case until at least six years after the earlier of the date the account was closed or the date on which the information was collected, provided, replaced, or updated." - [eCFR, 17 CFR 240.17a-4 (records to be preserved by brokers and dealers)](https://www.ecfr.gov/current/title-17/chapter-II/part-240/subject-group-ECFR17722751b422db3/section-240.17a-4), read 2026-11-03: "(10) All records required pursuant to § 240.17a-3(a)(24), as well as a copy of each Form CRS, until at least six years after such record or Form CRS is created." - [eCFR, 45 CFR part 164 subpart C (HIPAA Security Rule)](https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-C), read 2026-11-07: "Retain the documentation required by paragraph (b)(1) of this section for 6 years from the date of its creation or the date when it last was in effect, whichever is later." - [eCFR, 17 CFR 240.17a-4 (records to be preserved by brokers and dealers)](https://www.ecfr.gov/current/title-17/chapter-II/part-240/subject-group-ECFR17722751b422db3/section-240.17a-4), read 2026-11-03: "(b) Every member, broker or dealer subject to § 240.17a-3 must preserve for a period of not less than three years, the first two years in an easily accessible place:" - [eCFR, 17 CFR 240.17a-4 (records to be preserved by brokers and dealers)](https://www.ecfr.gov/current/title-17/chapter-II/part-240/subject-group-ECFR17722751b422db3/section-240.17a-4), read 2026-11-03: "(1) All records required under § 240.17a-3(a)(12) until at least three years after the associated person's employment and any other connection with the member, broker or dealer has terminated." - [eCFR, 17 CFR 240.17a-4 (records to be preserved by brokers and dealers)](https://www.ecfr.gov/current/title-17/chapter-II/part-240/subject-group-ECFR17722751b422db3/section-240.17a-4), read 2026-11-03: "(2) All records required under § 240.17a-3(a)(13) until at least three years after the termination of employment or association of those persons required by § 240.17f-2 to be fingerprinted." - [eCFR, 17 CFR 240.17a-4 (records to be preserved by brokers and dealers)](https://www.ecfr.gov/current/title-17/chapter-II/part-240/subject-group-ECFR17722751b422db3/section-240.17a-4), read 2026-11-03: "(4) All records required pursuant to § 240.17a-3(a)(14) for three years." - [eCFR, 17 CFR 240.17a-4 (records to be preserved by brokers and dealers)](https://www.ecfr.gov/current/title-17/chapter-II/part-240/subject-group-ECFR17722751b422db3/section-240.17a-4), read 2026-11-03: "(6) Each report which a securities regulatory authority or the Commodity Futures Trading Commission has requested or required the member, broker or dealer to make and furnish to it pursuant to an order or settlement, and each securities regulatory authority, Commodity Futures Trading Commission, or prudential regulator examination report until three years after the date of the report." - [eCFR, 17 CFR 240.17a-4 (records to be preserved by brokers and dealers)](https://www.ecfr.gov/current/title-17/chapter-II/part-240/subject-group-ECFR17722751b422db3/section-240.17a-4), read 2026-11-03: "spect to compliance with applicable laws and rules, and supervision of the activities of each natural person associated with the member, broker or dealer until three years after the termination of the use of the manual." - [eCFR, 17 CFR 240.17a-4 (records to be preserved by brokers and dealers)](https://www.ecfr.gov/current/title-17/chapter-II/part-240/subject-group-ECFR17722751b422db3/section-240.17a-4), read 2026-11-03: "(9) All records required pursuant to § 240.17a-3(a)(23) until three years after the termination of the use of the risk management controls documented therein." - [eCFR, 17 CFR 240.17a-4 (records to be preserved by brokers and dealers)](https://www.ecfr.gov/current/title-17/chapter-II/part-240/subject-group-ECFR17722751b422db3/section-240.17a-4), read 2026-11-03: "(11) The written policies and procedures required pursuant to §§ 240.15Fi-3, 240.15Fi-4, and 240.15Fi-5 until three years after termination of the use of the policies and procedures." - [eCFR, 17 CFR 240.17a-4 (records to be preserved by brokers and dealers)](https://www.ecfr.gov/current/title-17/chapter-II/part-240/subject-group-ECFR17722751b422db3/section-240.17a-4), read 2026-11-03: "(i) Each written agreement with counterparties on the terms of portfolio reconciliation with those counterparties as required to be created under § 240.15Fi-3(a)(1) and (b)(1) until three years after the termination of the agreement and all transactions governed thereby." - [eCFR, 17 CFR 240.17a-4 (records to be preserved by brokers and dealers)](https://www.ecfr.gov/current/title-17/chapter-II/part-240/subject-group-ECFR17722751b422db3/section-240.17a-4), read 2026-11-03: "(ii) Security-based swap trading relationship documentation with counterparties required to be created under § 240.15Fi-5 until three years after the termination of such documentation and all transactions governed thereby." - [eCFR, 17 CFR 240.17a-4 (records to be preserved by brokers and dealers)](https://www.ecfr.gov/current/title-17/chapter-II/part-240/subject-group-ECFR17722751b422db3/section-240.17a-4), read 2026-11-03: "(iii) A record of the results of each audit required to be performed pursuant to § 240.15Fi-5(c) until three years after the conclusion of the audit." - [eCFR, 17 CFR 240.17a-4 (records to be preserved by brokers and dealers)](https://www.ecfr.gov/current/title-17/chapter-II/part-240/subject-group-ECFR17722751b422db3/section-240.17a-4), read 2026-11-03: "(i) The written policies and procedures required to be adopted and implemented pursuant to § 248.30(a)(1) of this chapter until three years after the termination of the use of the policies and procedures;" - [eCFR, 17 CFR 240.17a-4 (records to be preserved by brokers and dealers)](https://www.ecfr.gov/current/title-17/chapter-II/part-240/subject-group-ECFR17722751b422db3/section-240.17a-4), read 2026-11-03: "(ii) The written documentation of any detected unauthorized access to or use of customer information, as well as any response to, and recovery from such unauthorized access to or use of customer information required by § 248.30(a)(3) of this chapter for three years from the date when the records were made;" - [eCFR, 17 CFR 240.17a-4 (records to be preserved by brokers and dealers)](https://www.ecfr.gov/current/title-17/chapter-II/part-240/subject-group-ECFR17722751b422db3/section-240.17a-4), read 2026-11-03: "cumentation from the United States Attorney General related to a delay in notice, as well as a copy of any notice transmitted following such determination, for three years from the date when the records were made;" - [eCFR, 17 CFR 240.17a-4 (records to be preserved by brokers and dealers)](https://www.ecfr.gov/current/title-17/chapter-II/part-240/subject-group-ECFR17722751b422db3/section-240.17a-4), read 2026-11-03: "(iv) The written policies and procedures required to be adopted and implemented pursuant to § 248.30(a)(5)(i) of this chapter until three years after the termination of the use of the policies and procedures;" - [eCFR, 17 CFR 240.17a-4 (records to be preserved by brokers and dealers)](https://www.ecfr.gov/current/title-17/chapter-II/part-240/subject-group-ECFR17722751b422db3/section-240.17a-4), read 2026-11-03: "(v) The written documentation of any contract or agreement entered into pursuant to § 248.30(a)(5) of this chapter until three years after the termination of such contract or agreement; and" - [eCFR, 17 CFR 240.17a-4 (records to be preserved by brokers and dealers)](https://www.ecfr.gov/current/title-17/chapter-II/part-240/subject-group-ECFR17722751b422db3/section-240.17a-4), read 2026-11-03: "(vi) The written policies and procedures required to be adopted and implemented pursuant to § 248.30(b)(2) of this chapter until three years after the termination of the use of the policies and procedures;" - [eCFR, 17 CFR 240.17a-4 (records to be preserved by brokers and dealers)](https://www.ecfr.gov/current/title-17/chapter-II/part-240/subject-group-ECFR17722751b422db3/section-240.17a-4), read 2026-11-03: "(l) Records for the most recent two year period required to be made pursuant to § 240.17a-3(f) and paragraphs (b)(4) and (e)(7) of this section which relate to an office shall be maintained at the office to which they relate." ## Read in full, publishes no figure - [EUR-Lex, Regulation (EU) 2016/679 (GDPR)](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32016R0679), read 2026-09-26: every candidate on the page was refused - [HHS, HIPAA Security Rule](https://www.hhs.gov/hipaa/for-professionals/security/index.html), read 2026-10-10: read in full and no accepted figure on the page - [FINRA, SEA Rule 17a-4 and related interpretations](https://www.finra.org/rules-guidance/guidance/interpretations-financial-operational-rules/sea-rule-17a-4-and-related-interpretations), read 2026-09-15: read in full and no accepted figure on the page - [ICO, a guide to data security (UK GDPR)](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/security/a-guide-to-data-security/), read 2026-10-11: read in full and no accepted figure on the page ## Methodology Every row is a verbatim sentence read from the named source's own page through our fetch service on the date shown, hash-pinned to the stored read (the sha of the page's visible text; the raw page is mirrored to R2). 2 of the 6 named sources that could be read published a usable figure; 4 published none and are recorded as not published, never filled in; 0 could not be read (blocked, dead or unreachable) and count nowhere. The headline figures (median, minimum, maximum, quartiles) are over ONE figure per source for each breakdown it prices, in year (a source's median where its page yielded several accepted sentences for one breakdown), so a page that gives figures for several breakdowns gives one for each and N counts 3 figures, never sentences; 13 candidate sentence(s) were refused by a reviewer with the reason recorded. The fuller derivation this dataset is chartered to grow into (not yet what the figures above are; they are each source's own published figure as read): one row per requirement per regime holding the obligation, the retention period in years where one is set, and the technical control it implies (immutable or audit-trailed storage, access logging, encryption, data residency, deletion on request) - and the join that decides a purchase: which vendors in the pricing index can evidence each control, so a buyer in a regulated deal sees the shortlist their regulator leaves them rather than the whole market. The regimes conflict in one place and the dataset says so rather than smoothing it: a securities retention floor and a privacy storage-limitation duty pull opposite ways on the same document ## Sources - [eCFR, 17 CFR 240.17a-4 (records to be preserved by brokers and dealers)](https://www.ecfr.gov/current/title-17/chapter-II/part-240/subject-group-ECFR17722751b422db3/section-240.17a-4) (the publisher's own terms; quoted for reporting and comment) - [EUR-Lex, Regulation (EU) 2016/679 (GDPR)](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32016R0679) (the publisher's own terms; quoted for reporting and comment) - [eCFR, 45 CFR part 164 subpart C (HIPAA Security Rule)](https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-C) (the publisher's own terms; quoted for reporting and comment) - [HHS, HIPAA Security Rule](https://www.hhs.gov/hipaa/for-professionals/security/index.html) (the publisher's own terms; quoted for reporting and comment) - [FINRA, SEA Rule 17a-4 and related interpretations](https://www.finra.org/rules-guidance/guidance/interpretations-financial-operational-rules/sea-rule-17a-4-and-related-interpretations) (the publisher's own terms; quoted for reporting and comment) - [ICO, a guide to data security (UK GDPR)](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/security/a-guide-to-data-security/) (the publisher's own terms; quoted for reporting and comment) ## Cite or embed - The Data Room Compliance Rules carries 23 published figures read from 2 sources' own pages; the 22 published figures given by regime run from 3 to 6 year, read 7 November 2026. - 2 of the 6 named sources read in full publish a figure; 4 publish none, read 7 November 2026. - Data Room Compliance Rules, regime SEC Rule 17a-4: median 3 year across 1 source, read 7 November 2026. - Data Room Compliance Rules, regime SEC Rule 17a-4: median 18 month across 1 source, read 7 November 2026. - Data Room Compliance Rules, regime HIPAA Security Rule: median 6 year across 1 source, read 7 November 2026. - Data Room Compliance Rules, technical control data residency: median 2 year across 1 source, read 7 November 2026. Cite as: "virtualdataroomcompare.com Data Room Compliance Rules", updated 2026-11-08, https://virtualdataroomcompare.com/datasets/data-room-compliance-rules/. CSV: https://virtualdataroomcompare.com/datasets/data-room-compliance-rules.csv JSON: https://virtualdataroomcompare.com/datasets/data-room-compliance-rules.json Embed (plain HTML, static link back): see https://virtualdataroomcompare.com/datasets/data-room-compliance-rules/#median