Compliance Lock on Commvault with Immutablity on Data Domain

Hi ​@syedameerdxc 
 

Compliance Lock in Commvault can be used with deduplication-enabled storage pools. When Compliance Lock is enabled, it enforces retention policies at the storage pool level, ensuring that data cannot be deleted or have its retention reduced, even in deduplication environments.

This provides software-level immutability, protecting data against unauthorized deletion or modification within the Commvault interface.

Key points regarding Compliance Lock with deduplication:

• Retention Enforcement: Once Compliance Lock is enabled, retention settings on dependent copies cannot be lowered. This applies to all dependent copies in the storage pool, including those using deduplication.
• Deduplication Database (DDB) Sealing: In deduplication environments, the DDB becomes immutable upon sealing. Compliance Lock ensures that objects within the DDB remain protected until the DDB is eligible for aging and pruning, based on the retention settings.
• Irreversibility: Once enabled, Compliance Lock cannot be disabled, and retention cannot be decreased on WORM storage lock enabled copies, which also applies to deduplication-enabled storage pools.
• Scope: Compliance Lock is supported for all cloud storage vendors and agents, and works in tandem with WORM Storage Lock for enhanced data immutability, especially in environments that support object-level locking.

https://documentation.commvault.com/11.40/commcell-console/configuring_compliance_lock.html

Hi ​@syedameerdxc Yes, you can enable WORM storage lock with DD. 

You have to configured the retention-lock feature on Datadomain and activate the WORM Storage Lock on Commvault through the CommandCenter

Please follow

https://documentation.commvault.com/11.40/software/configuring_worm_storage_lock_01.html

​@Abhishek Narulkar what should be retention setting on DD (no of days) and on Commvault WORM lock. Should be same ? What is recommended?  DD retetnion should be less compared to Commvault WORM lock retention?

Both should be the same. If not, you may encounter some strange alignments. For example, either DD is retaining the data longer while Commvault wants to age it, or DD is unlocking the data while Commvault still has an active retention.