What a retention policy is
A data retention policy is a written rule about how long different kinds of information are kept and what happens to them afterward. It might say that job applications are kept for a set period after a decision, that supplier contracts are kept for a number of years after they end, and that website logs are deleted after a short time.
The policy usually contains a schedule listing categories of records, a retention period for each, and a disposal method, such as secure deletion, anonymization or transfer to an archive. Without it, organizations tend to fall into one of two habits: keeping everything forever because deleting feels risky, or deleting inconsistently and losing something important.
This article is general information. Retention requirements vary by country, sector and record type, and organizations with specific obligations should consult qualified legal and compliance professionals.
Why set schedules
Legal and regulatory reasons
Some laws and standards require certain records, such as tax, payroll or safety documents, to be kept for a minimum period. Others, especially in privacy, expect personal information not to be kept longer than needed for its purpose. These pull in different directions, which is why the policy has to be built carefully, record type by record type.
Reducing risk
Data that no longer serves a purpose still has to be protected. The more an organization holds, the more can be exposed in a data breach. Old data can also surface in legal disputes. Deleting what is no longer needed can reduce exposure, which links to the principle of data minimization.
Cost and efficiency
Storage, backups and the systems around them have costs, including the energy used by data centers. Large piles of outdated information also make it harder to find what matters. Deleting stale records can improve searches and lower expenses, although the saving is not guaranteed to be large.
Privacy commitments
If an organization tells people their data is held only as long as necessary, it needs a way to keep that promise. Retention rules also support requests under the right to erasure where one applies, since they define what can be deleted and what must be kept for another lawful reason. Whether something counts as personal data depends on the legal definition in use.
Business value
Some information remains useful for years: historical sales figures, product designs, institutional knowledge. Retention rules can distinguish between information worth keeping and clutter.
Factors that shape retention periods
- Legal minimums and maximums for the record type.
- Business need, such as how long a contract or warranty lasts.
- Possible disputes. Organizations may choose to keep records for as long as a claim could reasonably be brought.
- Sensitivity. The more sensitive the data, the stronger the case for a shorter period.
- Cost and practicality of keeping and finding it.
- Historical or research value, for institutions with a public or archival role.
Retention is not the same as backup
The two ideas are easy to confuse. Backups exist to restore data after loss or damage, as discussed in the article on data backup. Retention decides how long records stay in use or in storage at all. A subtle problem arises when deleted records still sit in old backups. Policies therefore often cover backups too, specifying how long copies are held and how deletion is handled over time. Similarly, a disaster recovery plan may depend on certain data being available, which should be reconciled with deletion schedules.
Legal holds
Organizations sometimes need to suspend deletion when there is a legal dispute, investigation or audit. This is often called a legal hold. A good policy provides a way to pause the normal schedule for specific records and to restart it afterward. Automated deletion without such a mechanism can destroy records that should have been preserved.
Putting a policy into practice
- Take inventory. Find out what data exists and where, including in email, shared drives and old systems.
- Classify. Group records into categories with similar needs.
- Set periods. Decide on retention periods with input from legal, operations, security and the business owners of each dataset.
- Assign responsibility. Name who runs deletions and who approves exceptions. This is a typical task within data governance.
- Automate where possible. Systems that enforce schedules are more reliable than reminders, but they should be tested carefully.
- Document disposal. Keep a record that deletions happened as planned.
- Review regularly. Laws, systems and business needs change.
Common pitfalls
- A policy exists on paper but nobody applies it.
- Deletion is so slow or manual that it never happens.
- Copies persist in places no one remembers, such as personal devices or exported spreadsheets.
- Periods are set arbitrarily rather than from actual requirements.
- Data is deleted that later turns out to be needed.
- Disposal is careless, leaving recoverable information on retired equipment. Proper handling is part of the wider issue of electronic waste.
Balancing both sides
Keeping too much invites risk, cost and clutter; deleting too soon can break legal duties or lose useful history. There is no universal answer, and different organizations will reasonably land on different periods. A defensible approach is one where each choice has a documented reason, is applied consistently and is revisited as circumstances change.