A data retention policy says how long each kind of company record is kept, why, who owns it and how it is deleted. Its working part is the retention schedule: one row per record category with a trigger, a period, the basis for that period and a disposal method. Leave a period UNKNOWN until counsel confirms it.
- The policy sets the rules; the schedule applies them to each record category.
- Every period needs a basis: a law, a regulator, a contract or a stated business need.
- Deletion waits for a legal hold check. Keeping records longer than needed has its own risk when they hold personal data.
FREE WORKING TOOL · NO ACCOUNT REQUIRED
Build a records retention schedule and download your CSV
Add a row for each record category. Record the event that starts the clock, the period and where that period comes from. Leave a period as UNKNOWN until someone confirms it.
This builder creates the file in your browser. Your entries are not submitted by this tool and disappear when you leave or reload. Use descriptions and invented examples, without private records or access details.
1 row in your working file. Save a download before leaving this page.
To share the tool, link to this page. Your downloaded file is a working document; it does not establish approval, rights, eligibility or an outcome.
Download the retention schedule template.
Use the free CSV builder on this page, or open the records retention schedule template with five filled example rows. No email or account is required.
This is a working template, not legal advice. Use it to organize facts and questions, then have qualified counsel review anything you sign, adopt or delete.
Start from your company data inventory: each category there becomes a row in the schedule. For a category whose fields are unclear, describe them first in the data dictionary template.
What a data retention policy contains
Keep the policy short and put the detail in the schedule. A workable outline has eight parts:
- Purpose: why the company keeps records for set periods and deletes them afterwards.
- Scope: which systems, formats, teams and subsidiaries the policy covers, including email, chat and backups.
- Roles: who owns each record category, who approves disposal and who maintains the schedule.
- The schedule: the record categories, triggers, periods and bases, kept as a separate document.
- Legal holds: who can suspend deletion when a dispute, audit or investigation is expected, and how holds are lifted.
- Disposal: how records are deleted or anonymised in each system, and how deletion is recorded.
- Exceptions: who may approve keeping a record longer, and where that decision is written down.
- Review: how often the schedule is checked, and who signs off changes.
The records retention schedule, column by column
Each row answers four questions: what starts the clock, how long the record is kept, why that long, and what happens at the end. The example rows below are illustrative; replace them with your own categories and confirmed periods.
| Record category | Retention trigger | Retention period | Basis for the period |
|---|---|---|---|
| Records supporting income tax returns | Later of the filing date or the due date | 3 years in the general case; longer in the situations the IRS lists | IRS: How long should I keep records? |
| Employment tax records | Date the tax becomes due or is paid, whichever is later | At least 4 years | IRS: How long should I keep records? |
| Personnel files of involuntarily terminated employees | Date of termination | At least one year; check state law and any open charge | U.S. EEOC recordkeeping requirements |
| Payroll records | Date of the payroll record | At least three years | U.S. EEOC recordkeeping requirements (ADEA) |
| Resolved support tickets | Ticket closed | UNKNOWN | Business need; storage limitation applies to any personal data |
US periods stated by regulators
Only use a period when you can point to where it comes from. Two federal sources state periods for common business records. Federal rules set minimums; state law, contracts and pending matters can require longer, so check each row with counsel.
Tax records. The IRS says to keep records supporting a tax return until the period of limitations for that return runs out. The clock starts when the return is filed, and "Returns filed before the due date are treated as filed on the due date." It lists "Keep records for 3 years" as the general case, 6 years if you do not report income that is more than 25% of the gross income shown on your return, and 7 years for a claim for a loss from worthless securities or a bad debt deduction. Employment tax records are kept "for at least 4 years after the date that the tax becomes due or is paid, whichever is later."
Employment records. The EEOC says employers keep all personnel or employment records for one year, and that the personnel records of an involuntarily terminated employee are kept for one year from the date of termination. Under the ADEA, payroll records are kept for three years.
Retention under the GDPR
The GDPR sets no fixed periods. Its storage limitation principle, Article 5(1)(e), requires personal data to be "kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed".
Your record of processing activities should also give, where possible, the envisaged time limits for erasure of each category of data (Article 30(1)(f)). A retention schedule is the natural place to decide them; the data mapping template shows where each category flows.
Retention and the value of company records
A schedule also tells you what history the company still has. Retained support histories, work orders and procedures can be of interest to AI developers, and a buyer will ask how far back a category goes and why. See which business records to keep so you can license them later for the system defaults that delete them. A schedule that records the basis for each period answers that question without exporting anything.
Do not extend a period because records might be valuable later. Where records hold personal data, a longer period needs its own basis. Origin Data Partners is an independent data partner that helps companies get their data bought; you can check whether your company could qualify with company details only, no records.
Common questions
What is a data retention policy?
A data retention policy is a company rule set for how long each kind of record is kept, why, who owns it and how it is disposed of. The detail sits in a retention schedule with one row per record category.
What is the difference between a retention policy and a retention schedule?
The policy states the rules, roles and approvals. The schedule applies them: for each record category it gives the trigger, the period, the basis for that period and the disposal method.
How long should a business keep tax records?
The IRS says to keep records until the period of limitations for the return runs out: 3 years in the general case, longer in the situations it lists, and at least 4 years for employment tax records. Confirm with your tax adviser.
How long must employers keep personnel records?
The EEOC says employers keep all personnel or employment records for one year, and payroll records for three years under the ADEA. State laws and open charges can require longer.
Does the GDPR set retention periods?
No. It requires personal data to be kept in identifiable form for no longer than is necessary for its purposes, so each company sets and justifies its own periods.
Is this retention policy template legal advice?
No. It is a working template for organizing your records and questions. Have counsel confirm each period before you adopt the policy or delete anything. Start from the inventory template.