Data Retention Policy Template
What records are kept, for how long, why, and how they are destroyed.
Details
data retention policy templateUploads
Your logo
A photo or picture
Goes on this page only. Drag it anywhere and pull its corner to resize it.
Your signature
Draw it with a finger, a mouse or a trackpad, and it goes on the page like a picture.
Pictures and signatures stay on this device. Nothing is uploaded to a server.
Red highlights mark what is still blank. Click anything on the page to change it. Your draft is kept on this device as you work.
| Applies to | [who it applies to] |
| Owner | [owner] |
| Effective from | October 14, 2026 |
| Next review | [date] |
1. The principle
Records are kept for as long as there is a reason to keep them, and no longer. Keeping everything indefinitely is not caution — it increases what is lost in a breach and what must be searched in a dispute.
2. Retention periods
| Record | Kept for | Why |
|---|---|---|
| [add one record type per line] |
3. How records are destroyed
[method, and who records that it was done]
4. Legal holds
Where litigation, an investigation or an audit is under way or reasonably expected, destruction of anything that might be relevant stops immediately and does not resume until the organization says so in writing — whatever the table above says.
What is a Data Retention Policy?
A data retention policy states what records your organisation keeps, for how long, on what basis, and how they are destroyed. Both directions carry risk: destroying a record you were required to keep leaves you unable to answer a regulator or defend a claim, and holding personal data long after its purpose has ended breaches data protection law and enlarges every breach you will ever have. The policy is where those two pressures are settled deliberately.
Every organisation holding employee, customer or supplier records needs one, which is every organisation. It is used by IT setting backup and archive rules, by HR deciding how long to keep applications and disciplinary files, by finance holding invoices and payroll, and by whoever answers a subject access request or applies a litigation hold. It also appears as a standard line item in supplier due diligence questionnaires, information security certification audits and cyber insurance applications, so an absent policy has commercial as well as legal cost.
Retention periods come from several places at once, so name each source. Tax and company law set minimum record-keeping periods — check the rules of your revenue authority and companies legislation. Employment, health and safety, financial services, health and education rules add sector minimums. Limitation periods for claims differ by country and by type of claim. Data protection regimes, including UK and EU GDPR, US state privacy laws, India's DPDP Act, and Canadian and Australian privacy law, generally require you not to keep personal data longer than necessary rather than naming a number.
The policy does not authorise deletion of anything under a litigation hold, a regulatory investigation or a preservation order, and it must say so explicitly. It is not a records inventory: you still need to know where data actually lives, including backups, personal drives, shared mailboxes and third-party systems. And it does not make deletion happen. A schedule with no technical enforcement behind it is one of the most common audit findings there is, and it documents that you knew.
What to put in a Data Retention Policy
These are the details this template asks for. Anything left blank is marked in red on the preview so you can see what is still missing.
| Field | What goes in it |
|---|---|
| Issuing organisation | For example: Maple Grove Homeowners Association |
| Organisation address | For example: 1420 Kinnear Road, Columbus, OH 43212 |
| Who this applies to | For example: All employees, contractors and anyone posting on a company account |
| Policy owner | For example: Head of People |
| Next review | Free text |
| What is kept, and for how long | One per line: Record | Kept for | Why |
| How records are destroyed | For example: Paper is shredded on site. Digital records are deleted from live systems and from backups… |
| If the policy is not followed optional | For example: Unapproved absence may be treated as unauthorised and dealt with under the disciplinary… |
How to write a Data Retention Policy
Inventory what you actually hold
Before writing any periods, list the record categories: employee files, recruitment records, payroll, customer accounts, marketing consents, CCTV, call recordings, supplier contracts, financial records, system logs. For each, note the system it lives in, the owner, whether it contains personal or special category data, and whether copies sit in backups or with a processor. Guesswork here produces a schedule nobody can apply.
Set a period and name its source
Give every category a period and state where the period comes from: a statutory minimum, a limitation period for claims, a contractual obligation, or a documented business justification. Six years from the end of the relevant tax year, under the record-keeping rules that apply to us, is defensible. Indefinitely, for business reasons, is the line a regulator will ask about first.
Define the trigger, not just the duration
A period is useless without a start point. Say whether the clock runs from the end of the tax year, the end of the contract, the last transaction, the end of employment, the closure of a claim, or the date of collection. Records with no trigger event — an inactive customer account that never formally ends — are how databases quietly become permanent.
Specify how records are destroyed
Different media need different handling: secure deletion from live systems, expiry from backups, certified destruction of paper, wiping or physical destruction of drives and devices, and written instructions to processors and cloud providers. Say who signs off a destruction run and what record of it is kept, so you can show a record was destroyed routinely rather than conveniently.
Cover holds, exceptions and review
Set out how a litigation or regulatory hold is applied, who can impose and lift it, and how held records are flagged so an automated deletion job cannot catch them. List any category kept permanently or unusually long and justify it in the document. Name the policy owner and set a review cycle tied to legal and system changes rather than a vague annual promise.
Common mistakes
- Publishing a schedule your systems cannot enforce, so deletion never actually happens and you now hold a document proving you knew you were keeping data too long.
- Forgetting backups, archives and shadow copies on personal drives and shared mailboxes, so the primary record is deleted and the same data survives in four other places.
- Copying retention periods from a template written for another country's tax and limitation rules, so you either destroy records you were required to keep or hold personal data with no basis.
- Having no litigation hold process, so routine deletion continues after a claim becomes foreseeable — which courts in most jurisdictions treat as a serious matter in its own right.
- Applying one blanket period to everything, which is simultaneously too short for tax records and far too long for CCTV footage and unsuccessful job applications.
Frequently asked questions
How long should we keep employee records?
There is no single figure. Payroll and tax records carry statutory minimums, health and safety records have their own, and files that may be needed to defend a claim are usually kept for the limitation period for that claim type. Build the answer category by category from the tax, employment and limitation rules where you operate, and record which rule each period came from.
Does GDPR say how long we can keep data?
It sets no fixed periods. The storage limitation principle requires that personal data is not kept in identifiable form for longer than necessary for the purpose it was collected for, which puts the burden on you to set and justify periods. That is exactly why a written schedule matters: it is how you show the decision was made deliberately rather than never made at all.
What is the difference between a retention policy and a schedule?
The policy sets the principles, responsibilities, hold process and destruction standards. The schedule is the table itself: category, period, trigger, system, owner. Most organisations keep the policy short and hold the schedule as an appendix or spreadsheet, because the schedule changes far more often than the principles behind it do.
Can we just keep everything forever?
Not for personal data, and it is a poor idea for anything else. Beyond the data protection problem, every extra year of retained records is more to disclose in litigation, more to search on an access request, and more to lose in a breach. Cheap storage is not the constraint here; exposure is, and it compounds quietly.
Who is responsible for deleting data on time?
Name somebody. In practice ownership splits — a system owner runs the deletion, a business owner confirms nothing is on hold, and a policy owner keeps the schedule current — but a policy with no named roles produces a schedule nobody ever runs. Put job titles in the document and revisit them whenever people change roles.
This page explains general practice and is not legal advice. Requirements differ between countries and, in some cases, between states — check what applies where the document will be used.