A privacy engineer is building the organization's first data inventory to support Data Life Cycle Management. The engineering team has already catalogued each data store with system name, hosting location, data owner, and the categories of personal data held. During review, the DPO notes that the inventory cannot be used to enforce retention limitation or purpose limitation because a critical attribute is missing. Which attribute should be added to each inventory entry to MOST directly enable these controls?