Published November 13, 2026
What a retention policy has to do
A retention policy says how long each kind of record is kept, when it is deleted, who approves the deletion, and what stops deletion when litigation or an investigation is pending.
The GDPR requires that personal data be kept in identifiable form for no longer than is necessary for the purposes for which it is processed. The California Consumer Privacy Act requires a business to tell consumers how long it intends to keep each category of personal information, or the criteria for that period, and not to keep it longer than is reasonably necessary for the disclosed purpose.
Under the FTC Safeguards Rule, covered financial institutions must have procedures to dispose of customer information within two years of its last use for that customer, unless it is needed for business operations or another legitimate business purpose, the law requires it, or targeted disposal is not reasonably feasible. The rule also requires periodic review of the retention policy.
Keep it or delete it
The decision behind every line of the schedule is the same: keep the record for the longest period a law, contract or real business need requires, then delete it.
Keeping everything means more to search and produce in litigation, more to protect, and more to expose in a breach.
Deleting too early is the other failure. Under Federal Rule of Civil Procedure 37(e), when electronically stored information that should have been preserved for litigation is lost because a party did not take reasonable steps to preserve it, a court may order measures to cure the prejudice. If it finds intent to deprive, it may presume the information was unfavorable, instruct the jury so, or dismiss the case or enter a default judgment.
How to structure the schedule
| Approach | What it involves | Where it fits |
|---|---|---|
| Granular record series | One line per record type, each with its own period and legal citation. | Regulated records where an examiner will ask for the specific rule. |
| Big buckets | A small number of broad categories, each set to the longest period of the records it contains. | Unstructured content such as email, file shares and collaboration sites, where users must classify by hand. |
| System-based | A period set for a whole system or location, such as a mailbox, a site or a storage bucket. | Systems that hold one kind of record, and the default for content no one classifies. |
| Event-based | The clock starts at an event, such as an account closing, a contract ending or an employee leaving. | Customer, contract and personnel records, where creation date is the wrong trigger. |
The order of the work
- Inventory the records. List the systems that hold business records, what each holds, who owns it, and whether it contains personal data. Include SaaS applications, backups and archives.
- Collect the legal requirements. For each record type, record the period, the event that starts the clock and the citation. Have counsel confirm the list for each jurisdiction you operate in.
- Draft the schedule. Group record types into categories, set each category's period and trigger, and name an owner who approves deletion.
- Agree it with the owners. Business owners sign off on each category. Their objections can reveal real business needs or records the inventory missed.
- Write the legal hold procedure. Who can issue a hold, how it reaches the systems and the people, how it is tracked, and who releases it.
- Configure enforcement. Set retention and deletion in each system that supports it. Record the manual process for systems that do not.
- Clean up the backlog. Apply the schedule to existing data in stages, after checking each stage against open holds.
- Review on a cycle. Recheck the schedule when laws, systems or the business change, and at a fixed interval.
What takes longer than expected
- Owner sign-off. Owners are asked to approve deleting records they have never deleted. Plan for more than one round per category.
- Conflicting requirements. One record can fall under a tax rule, an employment rule and a privacy rule at once. Someone has to decide which period applies and document why.
- Systems that cannot delete. Check each application for retention settings and field-level deletion. Where either is missing, plan a manual process.
The detail plans leave out
- Holds override the schedule, everywhere. Plan for a hold to reach every copy: production systems, archives, exports, laptops and backups. In Microsoft Purview, content under an eDiscovery hold cannot be permanently deleted by any retention policy or label. Priority cleanup, a preview feature that needs three approvals, can override those holds.
- Deleted is not gone. In Microsoft 365, retained content that a user deletes moves to the Preservation Hold library in SharePoint and OneDrive or the Recoverable Items folder in Exchange. The Preservation Hold library counts toward the site's storage quota.
- Conflicting rules resolve to the longest period. By default, Purview applies retention over deletion, and the longest retention period wins.
- Immutable storage cuts both ways. In Amazon S3 Object Lock compliance mode, no user, including the account's root user, can delete a locked object version before its retention date.
- Backups need their own line. State the backup retention period in the policy. Deleted records stay in backups until those backups expire, and a restore can bring them back, so the restore procedure should reapply deletions made since the backup.
- Disposal needs a method. NIST SP 800-88 Rev. 2, Guidelines for Media Sanitization, published September 2025, covers sanitizing media so that access to the data is infeasible for a given level of effort.
Periods the schedule has to respect
Federal examples, from each agency's rule or guidance. State law, industry rules and contracts add more.
| Rule | Records | Period |
|---|---|---|
| IRS guidance | Income tax records, general case | 3 years |
| IRS guidance | Records for a bad debt deduction or worthless securities loss | 7 years |
| IRS guidance | Employment tax records | At least 4 years after the tax is due or paid, whichever is later |
| SEC Rule 17a-4(a) | Specified broker-dealer records | At least 6 years, the first 2 easily accessible |
| SEC Rule 17a-4(b) | Other specified broker-dealer records | At least 3 years, the first 2 easily accessible |
| 17 CFR 210.2-06 | Auditor workpapers for issuer audits and reviews | 7 years after the audit or review concludes |
| HIPAA, 45 CFR 164.316(b)(2) | Security Rule policies, procedures and required records of actions and assessments | 6 years from creation or last effective date, whichever is later |
| EEOC, 29 CFR 1602.14 | Personnel and employment records | 1 year from the record or the personnel action, whichever is later; records relevant to a discrimination charge until final disposition |
SEC Rule 17a-4 also governs how broker-dealer records are stored electronically: the system must keep a time-stamped audit trail of changes and deletions, or store records in a form that cannot be rewritten or erased.
The GDPR lists retention in two documents. The privacy notice must give the storage period or the criteria for it, and the record of processing activities must give, where possible, the time limits for erasure of each category of data.
Skills and operations
A retention policy needs legal, records management, privacy, security and IT in the same room. Give legal the periods and the holds, and IT enforcement.
Someone has to watch deletion jobs, approve disposition, track open holds, and report each period on what was deleted and what was kept and why. In Purview, disposition review lets named reviewers approve deletion at the end of a retention period.
Settle these first
- Who owns the policy, and who approves deletion for each category?
- Which jurisdictions and regulators apply, and has counsel confirmed the periods?
- Who can issue and release a legal hold, and how does it reach every system?
- How will you show, each year, that deletion ran on schedule?
Questions
- How long should a company keep records?
- As long as the longest law, contract or business need that applies to that record type, and then no longer. Periods differ by record: the IRS says 3 years for income tax records in the general case and at least 4 years for employment tax records, and SEC Rule 17a-4 sets 6 or 3 years for broker-dealer records.
- Does a legal hold override the retention schedule?
- Yes. The Committee Notes to Rule 37(e) cite court decisions holding that the duty to preserve relevant information begins when litigation is reasonably foreseeable. Scheduled deletion of that information has to stop. The Notes say reasonable steps suffice and perfection is not required.
- Does the GDPR set retention periods?
- No fixed periods. It requires keeping personal data no longer than necessary for its purpose, telling people the storage period or the criteria for it, and recording erasure time limits where possible.
- Can we keep data longer than the schedule if a customer asks us to delete it?
- The GDPR right to erasure does not apply where processing is needed to comply with a legal obligation under EU or member state law, or to establish, exercise or defend legal claims. Record which exception applies to each record you keep.