Keeping everything is not a safe default
It is tempting to keep all data forever, since storage is cheap and deleting feels risky. But data held longer than needed has costs: it must be protected, searched, backed up and sometimes disclosed. If systems are breached, old information can be exposed that nobody even remembered holding. On the other hand, deleting too early can break legal or contractual obligations or remove records the organization needs.
A data retention schedule resolves this by deciding, in advance and in writing, how long each type of data is kept and what happens to it afterward.
What drives retention periods
Several considerations push in different directions:
- Legal and regulatory requirements. Some records, such as financial, employment or tax documents, must typically be kept for a minimum period. Requirements vary by country, sector and record type, so confirm them with qualified advisers instead of copying a number from elsewhere.
- Privacy rules. Many privacy regulations expect that personal data is kept no longer than needed for its purpose. This ties in with data minimization, the idea of collecting and holding only what you need.
- Business need. Operational records may be useful for a while for support, analysis or disputes.
- Disputes and investigations. If a legal matter is pending or reasonably expected, relevant records are usually placed on hold and must not be deleted, even if the schedule says otherwise.
- Cost and risk. The more you hold, the more there is to protect and manage.
Building a schedule
A workable schedule need not be elaborate. For small organizations, a table is often enough:
- List the categories of data. For example: customer records, invoices, employee files, support tickets, marketing lists, system logs, email, and backups.
- Identify an owner for each category. Someone should be accountable for decisions about it.
- Set a retention period and its reason. Record why, whether legal, contractual or practical, so it can be reviewed later.
- Define the trigger. Does the clock start at creation, at the end of a contract, when an account closes, or at the end of the financial year?
- Decide the disposal method. Deletion, anonymization, or secure destruction of physical media.
- Note exceptions. Include how legal holds are applied and lifted.
Classifying information by sensitivity through data classification helps decide how careful disposal must be. A list of public product descriptions and a file of identity documents do not call for the same treatment. Knowing what counts as personal data helps you spot where privacy-driven limits apply. These rules belong with other IT policies so staff can find and follow them.
Retention and backups
Backups complicate retention. A record deleted from a live system can survive in backup copies for as long as those copies are kept. That is not necessarily a problem, but it should be a conscious decision. Many organizations let backups expire on their own cycle and document this clearly, while ensuring that restored data is checked against deletions made since. If someone asks for their information to be erased, such as in subject requests, you will need to know how backup copies are treated and be able to explain it.
Also remember that archiving is not the same as backing up. An archive keeps old data for reference; a backup exists to restore service. Mixing them up leads to either missing archives or backups that grow without limit.
Secure deletion
Deleting a file normally removes the pointer to it, not the contents, which may remain on the storage until overwritten. Proper disposal depends on the medium:
- Files and records in systems. Delete them in the application and confirm that related copies, such as exports and attachments, are also dealt with.
- Hard drives and similar media being reused. Approved erasure tools can overwrite data. For devices that use flash storage, behavior differs, so built-in secure erase features or encryption-based approaches are often preferred over simple overwriting.
- Encrypted data. If data was protected with data encryption, destroying the keys can make it unreadable, which is sometimes used as a disposal method, provided the keys are truly gone and the encryption was sound.
- Media at end of life. Physical destruction, through a reputable process, is typically used for failed or retired devices that cannot be erased reliably.
- Paper. Shredding or secure collection.
- Cloud and hosted services. Check how the provider handles deletion, and what the exit process looks like when you leave a service. Providers’ deletion may take time to propagate.
Keep a record of what was disposed of, when, how and by whom. Disposal records are valuable if you are ever asked to demonstrate that data was handled properly. The disposal stage of hardware connects naturally to asset management, which tracks devices through to their retirement.
Putting it into practice
Assign someone to run the schedule, automate deletion where systems allow, and review the schedule periodically since business activities and laws change. Train staff so personal copies and forgotten spreadsheets do not undermine the rules. When in doubt about legal periods, seek qualified advice. The aim is not to delete as much as possible, but to keep what you need, for as long as you need it, and no longer.