Data Retention and Destruction Policy
- Document ID
- PDC-DRD-SAMPLE
- Document version
- 1.0
- Template version
- v1.0.1
- Effective date
- October 2, 2026
- Next review
- October 2, 2027
1. Purpose
This policy sets how long [Company Name] (the "company") keeps its records, how it suspends destruction when a legal hold applies, and how it destroys records and storage media securely when they are no longer needed. Keeping records for the right period meets legal and business needs; destroying them on schedule reduces storage cost and the harm of any breach or lawsuit.
2. Scope and Definitions
This policy applies to all records created or received by [Company Name] in the course of business, in any form, including paper, email, documents, databases, cloud services, backups, phones, and removable media, and to every employee and contractor who creates, keeps, or disposes of them.
- Record
- Information, in any form, that documents a business activity, decision, transaction, or obligation of the company.
- Retention period
- How long a record must be kept before it may be destroyed, counted from the event named in the schedule.
- Legal hold
- An instruction from management or legal counsel to keep specified records, overriding the retention schedule, because of actual or reasonably expected litigation, investigation, audit, or claim.
- Sanitization
- Making data on storage media unrecoverable, using the Clear, Purge, or Destroy methods described in NIST SP 800-88.
- Certificate of destruction
- A written record, from staff or a vendor, of what was destroyed, when, how, and by whom, with serial numbers for devices.
3. Roles and Responsibilities
| Role | Responsibilities |
|---|---|
| Office Manager (policy owner) | Maintains the retention schedule, coordinates the yearly review and clean-out, keeps destruction records, and manages disposal vendors. |
| Chief Executive Officer | Approves this policy and changes to the schedule, and issues or approves legal holds with counsel. |
| Department managers | Make sure their records follow the schedule and identify records their customers' contracts require to be kept longer. |
| IT staff or IT provider | Configures automatic retention in email and business systems, applies legal holds in systems, and sanitizes devices. |
| All personnel | Keep records in approved company systems, never destroy records under a legal hold, and place paper for destruction only in secure bins or shredders. |
4. Retention Principles
- Records are kept for the period in the retention schedule, and then destroyed securely unless a legal hold applies.
- Records are stored in approved company systems and locations, not on personal devices or personal accounts.
- Copies and drafts are not kept longer than the official record.
- When the schedule does not list a record, it is kept for the period of the most similar record type until the policy owner adds it.
- Backups are kept on their own short rotation and are not used to keep records beyond their retention period.
5. Retention Schedule
The company keeps the following records for the periods shown, counted from the event named, and then destroys them securely unless a legal hold applies. The basis column explains where each default comes from; confirm each with legal counsel and the company's accountant, and record any longer period required by state law, contracts, or industry rules.
| Record | Keep for | Basis |
|---|---|---|
| Tax returns and the records that support them (invoices, receipts, bank statements, general ledger) | 7 years after the return is filed | IRS periods run 3 years in most cases, 6 years if income was underreported by more than 25%, and 7 years for bad debt or worthless securities. Seven years covers all three. |
| Records for property and equipment (purchase, improvements, depreciation) | 7 years after the year the asset is sold or disposed of | IRS: keep until the period of limitations expires for the year you dispose of the property. |
| Annual financial statements and audit reports | Permanently | Recommended practice for business history, lending, and sale of the business. |
| Payroll records and employment tax records | 4 years after the tax is due or paid, whichever is later | IRS minimum for employment tax records; covers the 3-year FLSA and ADEA payroll minimums. |
| Time cards, wage rate tables, and work schedules | 3 years | FLSA minimum is 2 years; 3 years matches payroll. |
| Personnel files (applications, evaluations, discipline, separation) | 3 years after employment ends | EEOC minimum is 1 year from the record or termination; a longer period covers common claim deadlines. Confirm with counsel. |
| Form I-9 employment eligibility forms | 3 years after hire or 1 year after employment ends, whichever is later | USCIS requirement. Store separately from personnel files. |
| Background check and consumer reports used for hiring | As long as needed for the hiring decision and any dispute, then destroy securely | FTC Disposal Rule requires secure destruction. |
| OSHA 300 Log, annual summary, and 301 incident reports | 5 years following the end of the calendar year they cover | OSHA 29 CFR 1904.33. |
| Signed contracts, leases, and amendments with customers, vendors, and landlords | 7 years after the contract ends | Recommended to cover claim deadlines. Confirm the statute of limitations with counsel. |
| Customer orders, quotes, and correspondence | 7 years after the last transaction | Matches tax record retention. |
| Product designs, drawings, specifications, and quality records | Life of the product plus the period required by customer contracts, certifications, or warranties | Customer and quality standard requirements vary. Record the longest one that applies. |
| Articles of incorporation or organization, bylaws, operating agreements, minutes, ownership records, licenses, and permits | Permanently | Recommended practice; these prove the company's existence and authority. |
| Insurance policies and claims | Permanently for occurrence-based policies; otherwise 7 years after expiration or claim closure | Old occurrence policies can still respond to claims years later. |
| Ordinary email that is not itself a business record | 3 years from the date sent or received | Company choice. Email that is a business record is filed and kept on that record's schedule. |
| Security and system logs | At least 12 months | Supports investigations; may be longer where the information security policy, a contract, or a standard requires. |
6. Electronic Records and Email
Email or chat messages that are business records, such as approvals, contracts, and customer commitments, are saved to the appropriate company system and kept on that record's schedule. Personal email accounts, personal cloud storage, and text messages on personal phones are not used to keep company records.
Automatic retention. The IT staff or provider configures retention rules in email and business systems to delete records automatically when their period ends. The Office Manager approves the rules, and they are paused for any person or system under a legal hold.
7. Legal Holds
When litigation, a government investigation, an audit, or a claim is pending or reasonably expected, the Chief Executive Officer, with legal counsel, issues a written legal hold. The hold names the records, people, and systems covered. From that moment:
- All covered records, in every form, are kept, even if their retention period has ended.
- Automatic deletion and email expiry are suspended for the covered people and systems, and devices of covered people are not wiped or recycled.
- Each person who receives a hold notice confirms in writing that they will comply.
- Only legal counsel may release a hold, in writing. Normal retention resumes after release.
Anyone who learns of a possible claim or investigation tells the Office Manager immediately. Destroying records covered by a hold can result in severe legal penalties and is a serious violation of this policy.
8. Secure Destruction of Paper Records
Paper records containing Confidential, personal, or financial information are placed in locked shredding bins and destroyed by a shredding company, so they cannot practicably be read or reconstructed. The company receives a certificate of destruction for every pickup. Ordinary recycling bins are never used for these records.
Large clean-outs. Boxes of old records are reviewed against the schedule and checked for legal holds by the Office Manager before they are destroyed, and the destruction is recorded.
9. Secure Destruction of Devices and Media
Every device or medium that has stored company information, including computers, servers, external and USB drives, phones and tablets, copiers and printers with hard drives, network equipment, and backup media, is sanitized before it is reused, returned at the end of a lease, sold, donated, or thrown away. Sanitization follows NIST SP 800-88, Guidelines for Media Sanitization:
| Method | What it means | When the company uses it |
|---|---|---|
| Clear | Overwriting all user-accessible storage, or a factory reset where that is the only option. | Devices reused inside the company that held no Confidential information. Not relied on for solid-state drives. |
| Purge | A stronger method, such as cryptographic erase or the drive's built-in sanitize command, that defeats laboratory recovery. | Devices leaving company control that will be reused, resold, or returned at the end of a lease. |
| Destroy | Physically shredding, disintegrating, pulverizing, or incinerating the media. | Failed or end-of-life drives, any media that held Restricted or regulated information, and any device that cannot be reliably purged. |
Proof of destruction. Devices are released only to an IT asset disposal company approved under this policy, which provides a certificate listing each device by serial number, the method used, the date, and who performed it. The IT staff or provider removes devices from the asset inventory only when the certificate is received.
Cloud services. When a cloud service or vendor relationship ends, the company obtains written confirmation that its information was deleted, in line with the contract and the vendor management process.
10. Disposal Vendors
Before hiring a shredding or IT asset disposal company, the Office Manager does due diligence, such as reviewing an independent audit of its operations, checking references, confirming any recognized industry certification, and reviewing its information security procedures. The contract requires it to protect the information during pickup, transport, and destruction, to destroy it so it cannot practicably be read or reconstructed, and to provide a certificate of destruction.
North Carolina law. North Carolina G.S. 75-64 requires businesses to take reasonable measures to protect against unauthorized access to personal information when disposing of it, including burning, pulverizing, or shredding papers and destroying or erasing electronic media so the information cannot practicably be read or reconstructed, and to put those procedures in writing as official policy. This policy is intended to serve as that written procedure, subject to review by counsel.
Consumer reports. Background checks and other consumer reports obtained for hiring or credit decisions are destroyed securely when no longer needed, as the FTC Disposal Rule requires.
11. Annual Review and Clean-Out
Once a year the Office Manager leads a records clean-out: departments review storage rooms, file cabinets, shared drives, and old systems against the schedule, confirm no legal hold applies, and send expired records for secure destruction. The results are recorded.
The schedule itself is reviewed at the same time, and whenever the company adds a new record type, system, customer requirement, or state of operation.
12. Exceptions, Enforcement and Review
Exceptions. A request to keep a record longer, or to destroy it sooner, than the schedule allows is made in writing to the Office Manager and approved by the Office Manager after confirming it does not conflict with any law, contract, or legal hold.
Enforcement. Destroying records under a legal hold, disposing of Confidential records in ordinary trash or recycling, or keeping company records in personal accounts may result in disciplinary action, up to and including termination, consistent with applicable law.
Policy review. The Office Manager reviews this policy no later than October 2, 2027. Changes are approved by the Chief Executive Officer.
13. Acknowledgment
I have read and understand the [Company Name] Data Retention and Destruction Policy. I will keep company records in approved systems for the required periods, dispose of them only through secure methods, and never destroy records covered by a legal hold.
Name
Job title
Signature
Date
14. Document Control and Revision History
| Field | Value |
|---|---|
| Status | Draft generated from a template. Not in effect until reviewed by your legal counsel and approved and signed below. |
| Document | Data Retention and Destruction Policy |
| Organization | [Company Name] |
| Document ID | PDC-DRD-SAMPLE |
| Document version | 1.0 |
| Effective date | October 2, 2026 |
| Next scheduled review | October 2, 2027 |
| Policy owner | Office Manager |
| Approver (title) | Chief Executive Officer |
| Source template | Preferred Data Corporation Data Retention and Destruction Policy template v1.0.1 |
| Template content last reviewed | October 2, 2026 |
Approval. Sign below to approve this document for adoption by [Company Name] after it has been reviewed by your legal counsel. Until it is signed, it is a draft and is not in effect.
Name
Title
Signature
Date
Revision history. Record every change to this policy below. Increase the document version and obtain approval again each time the policy is revised.
| Version | Date | Description of change | Approved by |
|---|---|---|---|
| 1.0 | October 2, 2026 | Draft generated from template v1.0.1; pending legal review and approval | Blank |
| Blank | Blank | Blank | Blank |
| Blank | Blank | Blank | Blank |
15. Template Notice and Legal Disclaimer
This document was generated from a starter template provided by Preferred Data Corporation. It is general information only. It is not legal advice and it is not a substitute for advice from a licensed attorney. Using the template does not create an attorney-client, consulting, or other professional relationship.
Preferred Data Corporation is not a law firm or an insurer. It makes no representation that this document is complete, current, or suitable for any particular organization, industry, jurisdiction, or regulatory requirement. To the fullest extent permitted by law, it is not responsible or liable for any loss or damage arising from the use of this template or of any policy created from it. You are solely responsible for how you adapt, adopt, and enforce it.
Laws, regulations, insurance requirements, and contracts that apply to your organization may require different or additional terms. The facts, deadlines, and legal references in this template were checked against their sources on the date shown as "Template content last reviewed" in Document Control, not on the effective date, and may have changed since. Before you adopt, publish, or rely on this document, and in every case where you have a legal, regulatory, or contractual obligation, have it reviewed by qualified legal counsel.
In an actual security incident or data breach, contact your attorney, your cyber insurer, and law enforcement where appropriate. Do not rely on this template alone to decide whether, when, or how to notify anyone.
If Preferred Data Corporation prepared this document for you as part of its services, your service agreement governs those services. The content of this document is still general information and should be reviewed by your own counsel before you adopt it.
This template is provided "as is", without warranties of any kind, including accuracy, completeness, or fitness for a particular purpose. Links to laws, agencies, and other websites are provided for convenience and may change. Use of this template is also subject to the Website and Free Resources Disclaimer and the Terms of Service at preferreddata.com/legal/disclaimer and preferreddata.com/legal/terms-of-service.
To report an error, contact Preferred Data Corporation at preferreddata.com/contact or (336) 886-3282 and include the Document ID shown in Document Control. Corrections are listed in the template changelog on the template's page at preferreddata.com/policy-templates.
