Every business accumulates records — contracts, invoices, tax filings, personnel files, a decade of email — under a default policy nobody chose: keep everything, forever, wherever it landed. It feels safe. It isn’t: unlimited retention means unlimited discovery exposure (everything you kept can be subpoenaed), unlimited breach surface (old data leaks just as painfully as new), growing storage cost, and — increasingly — actual legal risk, since privacy laws have started requiring that some data not be kept past its purpose. The alternative is a one-page retention schedule: what you keep, how long, and when it goes. Here’s how to build one — with the standing caveat that where law is involved, the numbers come from your accountant and attorney, not a blog, ours included.
The categories that have real rules
Most retention obligations cluster in a handful of buckets: tax and financial records — returns, supporting documents, and payroll records carry IRS-driven periods (commonly cited in the several-to-seven-year range, with state wrinkles; your accountant has the exact numbers for your situation) · employment records — applications, personnel files, I-9s, benefits and injury records, each with its own federal and state clocks · contracts and corporate records — generally kept for the life of the agreement plus your state’s statute of limitations, with formation documents and minutes kept permanently · and industry-specific regimes — healthcare’s medical-record rules, financial firms’ books-and-records, law firms’ matter files — where the regulator’s number is the number. The schedule’s job isn’t legal scholarship; it’s putting each category on one page with its period and its source (“per CPA, per counsel, per HIPAA”), so the next question has a written answer.
The distinctions that prevent the classic confusions
Three lines keep the schedule honest. Records retention ≠ backup retention. Backups are a recovery mechanism with their own (shorter, tiered) clock; the records schedule governs the live systems and archives where the authoritative copies live — and regulators care about the latter. A subtle corollary: data you’re required to delete shouldn’t quietly persist in either place. Retention ≠ email retention alone. Email is one container; the schedule follows the record type wherever it lives — the SaaS platforms included, which is where modern records increasingly hide. The schedule pauses for litigation. A legal hold — actual or reasonably anticipated litigation — freezes deletion for anything relevant, overriding every period on the page. The schedule needs that sentence in bold, plus the trigger: possible litigation → call counsel before anything is deleted, the same reflex as the incident plan’s.
The disposal half is a policy, not a shrug
“Then it goes” needs the same deliberateness as “keep it”: deletion on schedule, documented (a one-line log — what category, what period ended, when disposed — is what makes disposal defensible rather than suspicious) · secure disposal for anything sensitive — proper destruction for drives and devices, not a recycling-bin gesture · and the systems configured to help: Microsoft 365’s retention machinery can enforce keep-then-delete automatically per category, which converts the schedule from a memo into a mechanism. That automation is the difference between a policy and a hope — memos don’t delete anything.
Building it: one afternoon, three sources
The practical build: list your record categories (the data classification pass already found most of them and where they live) · get periods from the three sources — accountant for financial, attorney for legal and employment, regulator for industry — an email to each with the category list usually suffices · write the page: category, period, source, system where it lives, disposal method · then wire it in: the retention tooling configured, the annual check added to the yearly review, and new systems assigned a retention line at adoption. Revisit when the business changes — new state, new service line, new regulator — because retention obligations follow the business, not the calendar.
The bottom line
Keep-everything-forever is a policy too — just an accidental one, with real costs. The deliberate version fits on a page: categories, periods sourced from professionals, a litigation-hold override in bold, and disposal that’s scheduled, secure, and logged — enforced by the systems rather than by memory. An afternoon to write, an email to two professionals, and the business knows, in writing, what it keeps and why — which is the entire ask behind most of the questionnaires, audits, and awkward moments this document quietly prevents.