How long the library keeps user data depends on several factors, including legal regulations and operational considerations. Every library should have a retention policy. Your local governing body (school, city, county) may already have a retention policy that you can follow. There are very few items containing user data that should be kept forever! Make sure to check local and state regulations too. Some data may be exempt from retention regulations.
A library consortium should have retention policies and procedures for its member libraries to ensure the same level of user privacy throughout the consortium.
Create a record retention schedule for library data, including user data, system backups, and logs. Ensure that it is in compliance with local and state regulations.
How to Create a Strong Data Archiving Policy
This video give simple instructions for what to include in a data archving policy
Put this into action with the "Privacy Policies Field Guide"