Records Retention Schedule
Also known as: retention schedule, records management schedule, data retention policy, document retention schedule
A records retention schedule is a policy document that defines the minimum and maximum periods for retaining different categories of organizational records, based on legal requirements, regulatory obligations, and business needs.
It specifies not just how long to keep records but also when and how to destroy them securely: in many regulatory environments, retaining records beyond their required period is itself a risk. A retention schedule covers all record types: contracts, financial records, HR files, email, system logs, and customer data.
Records Retention Schedule, explained at three levels
At home
A records retention schedule is the document that answers 'how long do we have to keep this?' for every type of record your organization creates. Tax records might need to be kept for seven years. Employment records might need to be kept for the duration of employment plus several years. Customer data might need to be deleted within 90 days of a contract ending. The schedule tells everyone in the organization what to keep, for how long, and what to do with records when their time is up.
At work
A records retention schedule protects your organization in two ways: it ensures records are kept long enough to satisfy legal and regulatory requirements, and it ensures records are destroyed on schedule so you are not holding liability-generating data longer than necessary. Retaining records that should have been destroyed can harm you in litigation (the opposing side can demand them in discovery) and violates GDPR's storage limitation principle. The schedule needs to be reviewed annually and updated when regulations change.
At home
A records retention schedule typically lists: the record category (contracts, invoices, personnel files, system logs, customer records), the minimum retention period (driven by the most restrictive applicable legal requirement), the maximum retention period (after which destruction is mandatory), the legal or regulatory authority for the period, the responsible department or role, and the approved destruction method. Legal hold exceptions override the schedule: records subject to litigation holds must not be destroyed even if past their retention period.
At work
Retention periods vary significantly by record type and jurisdiction. Common US retention periods include: federal tax records (minimum 3-7 years), OSHA safety records (5-30 years depending on type), employment applications (1-3 years), bank records (5-7 years), and SOX-relevant audit records (7 years). GDPR requires personal data to be kept only 'for no longer than is necessary for the purposes for which the personal data are processed', which requires documented justification for every retention period applied to personal data.
At home
Automated retention management has become essential for organizations managing large volumes of electronic records. Enterprise content management (ECM) systems and records management tools can apply retention policies automatically, flag records approaching their destruction date, and enforce legal holds that prevent automatic destruction. Email archiving systems retain email for specified periods and allow systematic purging after the retention period. Without automation, employees making individual decisions about what to delete create inconsistent retention and compliance gaps.
At work
From a practitioner standpoint, the most common records retention failure is treating the schedule as a theoretical document rather than an operational one. A schedule that is not implemented in systems (where records are not actually deleted at the prescribed time) provides no benefit and creates potential liability. The second most common failure is not accounting for records in cloud services, personal devices, and shadow IT applications. A complete records inventory must precede a meaningful retention schedule: you cannot schedule what you do not know you have.
Real-world examples
At home
Sophie runs a small consulting business and was unsure how long to keep client contracts and invoices. After checking with her accountant, she learned the CRA requires tax-relevant records to be kept for six years. She created a simple spreadsheet listing each record type and its destruction date, and set calendar reminders to securely shred or delete records when their time came.
At work
The compliance team at Hartwell Financial reviewed their records retention schedule after a regulatory examination found records that should have been destroyed three years prior. The updated schedule mapped each record type to specific regulatory citations, was implemented in the document management system with automated deletion workflows, and included a legal hold register to track active exceptions.
Common confusions
- Records retention is not the same as backup. Backups exist to restore data after a failure: they should not be used to satisfy retention requirements, because backup systems are designed to be overwritten on a schedule. Records kept for compliance must be in a system with access controls, audit trails, and destruction scheduling, not on backup tapes that could be overwritten.
- Destroying records on schedule is not evidence tampering. Organizations sometimes hesitate to destroy records per their schedule, worried that doing so after a problem occurs might look suspicious. The correct approach is consistent, scheduled destruction documented by the retention policy: the destruction schedule must be followed regardless of whether litigation is anticipated. What is unlawful is destroying records after a litigation hold notice has been issued or when litigation is reasonably anticipated.
- A retention schedule must cover all formats and locations, not just paper. Email, instant messages, voicemails, cloud storage files, database records, and records in SaaS applications are all 'records' if they document a business activity or decision. Organizations that apply retention policies only to their file server while neglecting email and cloud platforms have a false sense of compliance.
For analysts
In BA artefacts, retention requirements surface as data lifecycle constraints for any system that creates or stores records. Before specifying data storage requirements, confirm the applicable retention period for each data category from the organization's retention schedule. Design for deletion: systems must have a mechanism to identify and destroy records that have reached their destruction date, including records in backups, archives, and cloud storage. Useful NFR: 'The system must support automated flagging of records reaching their retention period end date, with a mandatory approval workflow before destruction, and a tamper-proof audit log of all records destroyed.'
History & origin
Records retention requirements have existed as long as organized commerce and government. Ancient Roman law required certain commercial records to be kept for defined periods. Modern retention requirements in the US date to the Revenue Acts of the 1920s requiring businesses to retain tax records. The explosion of electronic records in the 1980s and 1990s (and the discovery that employees were deleting emails relevant to litigation) led to more formal records management programs and legal hold concepts. HIPAA (1996), SOX (2002), and GDPR (2018) each introduced specific retention and deletion obligations that made records management a compliance imperative rather than an administrative task.