An instruction preventing deletion of records that would otherwise reach their retention expiry.
Must override an otherwise-valid deletion, which puts it in direct tension with data minimisation obligations. That tension is why retention has to be policy-driven rather than either indefinite or ad hoc.