Timeouts
Users are warned of the duration of any user inactivity that could cause data loss, unless the data is preserved for more than 20 hours when the user does not take any actions.
In plain language
If being inactive for a while could make someone lose their data, the site needs to either warn them in advance how long they have, or simply keep their data safe for at least 20 hours even if they do nothing.
Why it matters
People need to know how much time pressure they're under so they can plan accordingly — stepping away, taking a break, or getting help. Without a warning or a long enough grace period, someone can come back to find all their work silently gone.
In practice
Fails this criterion
A tax filing site logs users out after just 1 hour of inactivity, with no warning anywhere about this time limit.
Meets this criterion
The same site either warns users clearly about the 1-hour limit before they start, or — even better — saves their entered data for 24 hours so nothing is lost even if they step away.
Test it yourself
Look for any process on the site that could time out (a long form, a multi-step application). Is there a clear warning about how long you have, or does your data stay safe for a long time regardless?