The IoT data lifecycle: collect, transmit, store, analyse, act, delete
In short: IoT data passes through six stages: collect, transmit, store, analyse, act and delete. Each stage has its own risks, from collecting more than you need to keeping data forever. Applying the right control at each stage protects privacy and keeps decisions trustworthy.
Why think in a lifecycle
Security often focuses on one point, such as encrypting the network link. But data is exposed at every stage of its life. Mapping the full lifecycle helps you spot gaps, explain your design to auditors and comply with data protection law, which requires you to know why you hold personal data and how long you keep it.
Stage by stage
| Stage | What happens | Key risk | Control |
|---|---|---|---|
| Collect | Sensors sample at an interval | Collecting more than needed | Data minimisation, sensible sample rate |
| Transmit | Device sends to gateway or cloud | Eavesdropping, tampering | TLS or DTLS, device authentication |
| Store | Data lands in a database or object store | Breach, unauthorised access | Encryption at rest, least-privilege access |
| Analyse | Rules, dashboards, machine learning | Bad data, wrong conclusions | Validation, data quality checks |
| Act | Alerts or commands back to devices | Forged or replayed commands | Signed commands, local safety limits |
| Delete | Data is removed at end of retention | Data kept forever | Retention policy, automated deletion |
Collect and transmit
Begin by asking what you really need. A building occupancy sensor might only need "room in use: yes/no" every five minutes, not a video stream. Less data means less to protect and less to leak. When you transmit, use Transport Layer Security (TLS) over TCP, or Datagram TLS (DTLS) over UDP, and authenticate the device with a certificate or key rather than a shared password. Include a timestamp or sequence number so old messages cannot be replayed.
Store and analyse
IoT data is mostly time-stamped readings, so it often goes into a time-series database. Encrypt it at rest, separate raw data from summaries, and restrict who can query it. Before analysis, check for impossible values, gaps and duplicates. A dashboard built on corrupt data produces confident but wrong decisions, which can be worse than no data at all.
Act and delete
When analysis triggers an action, such as unlocking a door, the command travels back down the chain. Sign commands, check them on the device and log who or what issued them. Finally, set a retention period for each data type. Raw high-frequency readings might be kept for 30 days, hourly averages for two years. Automate deletion, and remember backups and exported copies too. When a device is retired, wipe its stored credentials and data before disposal or resale.
Tip: in privacy terms, sensor data that seems harmless can become personal when combined. Electricity use every minute can reveal when someone wakes, cooks and leaves home. Treat such data as personal and apply UK GDPR principles where they apply.
Practice
What is data minimisation, and which lifecycle stage does it mainly apply to?
Why add a sequence number or timestamp to IoT messages?
Name two things to do when an IoT device is retired.
Key takeaways
- IoT data passes through collect, transmit, store, analyse, act and delete.
- Collect only what you need; it reduces risk and helps compliance.
- Encrypt in transit with TLS or DTLS and at rest in storage.
- Validate data before analysis and sign commands before acting.
- Set retention periods and automate deletion, including at device retirement.
Original content written by Mohamed Fayas for FM TecHub. © 2026 FM TecHub. You're welcome to share a link to this page; please don't copy the text elsewhere without permission.