How to Create a Data Retention Policy (With a Template)
A step-by-step guide and template for writing a data retention policy, covering data categories, US retention periods to check, deletion procedures and legal holds.
To create a data retention policy, inventory the data you hold, group it into categories, set a retention period for each based on legal requirements and real business need, assign owners, and write clear deletion and legal-hold procedures. Then automate deletion where you can and review the policy at least once a year.
Photo: Unsplash
On this page
Most businesses keep everything forever. Old customer exports sit in shared drives, former employees’ files live on in cloud storage, and a decade of emails fills the mail server. It feels safe. It isn’t.
Every record you keep is a record that can be breached, subpoenaed or misused. Privacy laws increasingly expect you to delete personal data you no longer need, while tax and employment rules require you to keep certain records for set periods. A data retention policy reconciles those 2 pressures in writing.
This guide walks you through building one step by step, with a template you can adapt and a table of common US retention periods to verify with your advisor.
This is not legal advice. Retention rules depend on your industry, states and contracts, so have a lawyer or accountant review your final schedule.
What a data retention policy is
A data retention policy is a written set of rules that says:
- What data your business holds, grouped into categories
- How long you keep each category
- Why you keep it that long (a law, a contract or a business need)
- Who owns each category
- How you delete or destroy it when the time is up
- When normal deletion pauses, such as during litigation
The table that lists each category and its retention period is often called a retention schedule. The policy is the schedule plus the rules around it.
Why you need one
There are 4 practical reasons, even for a small business.
- Legal requirements to keep records. Tax, payroll, hiring and safety rules set minimum retention periods.
- Legal pressure to delete records. Privacy laws and some security rules expect you not to keep personal data longer than necessary.
- Lower breach impact. Data you’ve deleted can’t be stolen. Smaller data stores also make recovering from a breach faster and cheaper.
- Lower cost and clutter. Less storage, faster searches, cleaner analytics and less to review if you ever face a lawsuit.
US laws that affect retention periods
Here are common federal rules to check. State laws, industry regulators and contracts can add longer periods.
| Record type | Minimum period to check | Source |
|---|---|---|
| General business income tax records | Generally 3 years from filing; 6 years if income was substantially underreported; 7 years for bad debt or worthless securities claims | IRS |
| Employment tax records | At least 4 years after the tax is due or paid, whichever is later | IRS |
| Payroll records under the Fair Labor Standards Act | At least 3 years (29 CFR 516.5); supplementary records such as time cards, 2 years (29 CFR 516.6) | US Department of Labor |
| Personnel and hiring records | 1 year from the record or personnel action, longer if a discrimination charge is filed (29 CFR 1602.14) | EEOC |
| Form I-9 | 3 years after the date of hire or 1 year after employment ends, whichever is later | USCIS |
| OSHA injury and illness logs | 5 years after the end of the calendar year they cover (29 CFR 1904.33) | OSHA |
| HIPAA policies and required documentation | 6 years from creation or when last in effect, whichever is later (45 CFR 164.316) | HHS |
Rules that push you to delete
- FTC Safeguards Rule. Financial institutions covered by the rule, which includes many non-bank businesses such as auto dealers, tax preparers and some lenders, must have procedures to securely dispose of customer information no later than 2 years after it was last used to serve that customer, unless it’s needed for a legitimate business purpose, required by law, or not reasonably feasible to delete. The amended rule took full effect on June 9, 2023 (16 CFR 314.4(c)(6)).
- California Consumer Privacy Act (CCPA). Since the CPRA amendments took effect on January 1, 2023, businesses covered by the CCPA must tell consumers how long they intend to keep each category of personal information, or the criteria used to decide, and may not keep it longer than reasonably necessary (Cal. Civ. Code 1798.100(a)(3)). Several other states have similar data minimization rules. See our guide to US state data privacy laws.
- GDPR, if you serve people in the EU, includes a storage limitation principle: personal data should be kept no longer than necessary for its purpose.
Key takeaway: A retention policy has 2 jobs: keep what the law and the business require, and delete everything else on schedule. Both halves matter.
Step-by-step: how to create your data retention policy
Step 1: Inventory your data
List where data lives: your CRM, accounting software, payroll provider, email, shared drives, ecommerce platform, support desk, backups and paper files. For each system, note what kinds of data it holds and whether it includes personal or sensitive information.
Don’t aim for perfection. A spreadsheet with 1 row per system is a strong start.
Step 2: Group data into categories
Retention works best by category, not by system. Common categories:
- Financial and tax records
- Payroll and employee records
- Recruiting and applicant records
- Customer and prospect data
- Contracts and legal documents
- Marketing data, such as email lists and analytics
- Operational data and logs
- Health or other sensitive data, if you handle it
Step 3: Set a retention period for each category
For each category, find the longest legal or contractual requirement, then ask what the business genuinely needs. Write down the trigger that starts the clock, such as “end of fiscal year,” “contract end date,” “employee termination date” or “last purchase.”
A period without a clear trigger is hard to enforce. “7 years” means little unless everyone knows when the 7 years start.
Step 4: Assign owners
Every category needs a business owner who approves the period and confirms deletion. HR owns employee records, finance owns tax and accounting, and so on. This fits neatly into a broader data governance setup.
Step 5: Write deletion procedures
Decide how deletion actually happens for each system:
- Automatic deletion rules in software where available, such as email retention policies or CRM data cleanup jobs
- Scheduled manual reviews, for example a quarterly cleanup of shared drives
- Secure destruction of paper records through shredding
- Media sanitization for old laptops, drives and phones. NIST published Special Publication 800-88 Revision 2, its updated guidelines for media sanitization, in September 2025.
Don’t forget backups. Deleted data often survives in backups. State how long backups are kept and accept that data will age out of them on that schedule. Our guide to backing up business data covers retention settings for backups.
Step 6: Add a legal hold process
When litigation, an audit or a government investigation is reasonably expected, you must stop deleting relevant records. Your policy should say who can issue a hold, how staff are notified, how automatic deletion is paused and who lifts the hold.
Step 7: Train, automate and review
Share a short summary with staff, build deletion into employee offboarding and system workflows, and review the policy at least once a year or whenever you add a major system, enter a new state or change how you use data.
Data retention policy template
Adapt this outline to your business.
1. Purpose. Explain that the policy sets how long the company keeps records and how it disposes of them, to meet legal obligations and reduce risk.
2. Scope. All records in any format, paper or electronic, created or received by the company, including those held by vendors on its behalf.
3. Roles. Policy owner (for example, operations manager), category owners, IT administrator, all staff.
4. Retention schedule. A table like this:
| Category | Examples | Retention period | Clock starts | Owner | Disposal method |
|---|---|---|---|---|---|
| Tax and accounting | Returns, ledgers, receipts | 7 years | End of tax year filed | Finance | Auto-delete; shred paper |
| Payroll | Pay records, timesheets | 4 years | End of tax year | Finance / HR | Payroll provider settings |
| Employee files | Offer letters, reviews | Per advisor review | Termination date | HR | Secure delete |
| Form I-9 | I-9 forms | 3 years after hire or 1 year after termination, whichever is later | Hire / termination | HR | Shred or secure delete |
| Applicants not hired | Resumes, interview notes | 1 year minimum | Hiring decision | HR | Secure delete |
| Customer accounts | Contact details, order history | Per business need and privacy law | Last purchase or account closure | Sales | CRM cleanup job |
| Marketing lists | Subscribers, campaign data | Until unsubscribe plus suppression list | Last engagement | Marketing | Platform deletion |
| System logs | Access and security logs | Per security needs | Log creation | IT | Rolling deletion |
5. Deletion procedures. How each system deletes data, who confirms it and where deletion is logged.
6. Legal holds. Who issues and lifts holds, and that holds override the schedule.
7. Exceptions. How to request one and who approves it.
8. Review. Annual review date and policy owner.
The periods in this template are illustrative. Confirm each one with your accountant or lawyer, and check state rules where you operate. You can find state-specific resources through our state top lists.
Common mistakes to avoid
- Keeping everything “just in case.” That increases breach exposure and discovery costs.
- Copying another company’s schedule. Their industry, states and contracts differ from yours.
- Ignoring vendor systems. Your payroll provider, email platform and cloud apps hold your data too. Check their retention settings.
- Forgetting backups and exports. Spreadsheets downloaded from your CRM are data too.
- Pasting data into tools you don’t control. Uploading customer data into consumer AI tools can create copies outside your schedule. Read whether it’s safe to put company data into AI.
- No proof of deletion. Keep a simple log of what was deleted and when.
Conclusion
A data retention policy tells your team what to keep, for how long and how to get rid of it safely. Start with an inventory, group data into categories, set periods tied to laws and real needs, and write deletion and legal-hold procedures. Automate what you can, review yearly, and have an advisor confirm the schedule. You’ll meet your recordkeeping duties while carrying far less risk.
Sources
- IRS: How long should I keep records? — federal tax and employment tax retention periods
- USCIS Handbook for Employers M-274: Retaining Form I-9 — Form I-9 retention rule
- eCFR: 29 CFR 1602.14, Preservation of records — EEOC personnel record retention
- OSHA: 29 CFR 1904.33, Retention and updating — injury and illness record retention
- NIST: SP 800-88 Rev. 2, Guidelines for Media Sanitization — media sanitization guidance published September 2025
- eCFR: 16 CFR 314.4, FTC Safeguards Rule elements — 2-year customer information disposal requirement
Frequently asked questions
What should a data retention policy include?
A data retention policy should include its purpose and scope, a list of data categories, a retention period and starting trigger for each, named owners, deletion and destruction procedures, a legal hold process, how exceptions are handled and a review schedule. The retention schedule table is the core, but the procedures around it are what make the policy work in practice.
How long should a business keep records?
It depends on the record type. Federal rules include generally 3 years for most income tax records, at least 4 years for employment tax records, 3 years for FLSA payroll records and 5 years for OSHA injury logs. State laws and contracts can require longer. Keep records for the longest applicable requirement, then delete them. This is not legal advice.
Is a data retention policy legally required?
No single US federal law requires every business to have a written retention policy. However, many laws set retention periods, and some, such as the FTC Safeguards Rule for covered financial institutions and the CCPA's disclosure rule, effectively require you to define and follow them. A written policy is the most practical way to show you comply.
How long can I keep customer data?
Keep customer data only as long as you have a legitimate need, such as an active account, warranty, legal requirement or tax record. The CCPA requires covered businesses to disclose retention periods and not keep data longer than reasonably necessary. The FTC Safeguards Rule sets a 2-year disposal rule for covered financial institutions. Set a period tied to last activity.
What is a legal hold?
A legal hold is an instruction to stop deleting records that may be relevant to expected or ongoing litigation, an audit or an investigation. It overrides your normal retention schedule until it is lifted. Your policy should name who can issue a hold, how staff and automated deletion are paused, and how the hold is released once the matter ends.
Do I need to delete data from backups?
You usually don't need to delete individual records from backups immediately, but your policy should state how long backups are kept so data ages out on a predictable schedule. Avoid restoring deleted personal data from backups into live systems. If you keep backups for many years, that effectively extends retention for everything in them, so set backup periods deliberately.
How often should a data retention policy be reviewed?
Review your data retention policy at least once a year. Also review it when you add a major system, start operating in a new state or country, begin collecting a new type of sensitive data, or when relevant laws change. Each review should confirm periods are still accurate, owners are still correct and deletion is actually happening.
Was this guide useful
No reviews yet. Share your experience and help other readers.
Write a review
Manishdai
Manishdai writes about the technology that is reshaping every industry — from AI agents and cloud platforms to healthtech, fintech and the IT companies building it all across the United States.
manishdai.com