In Sarbanes-Oxley, does anyone know why the figure of 7 years was chosen as the data retention period (and not, say, 6 or 8 years)?
1 Answer
This is not really a legal question; it's more a question about the political process to finalize the law or one about technical implementations of the act's requirements. Try
https://www.sec.gov/rules/final/33-8180.htm
http://www.sarbanes-oxley-forum.com/modules.php?name=Forums&file=viewtopic&p=10121