Stop deleting it: which business records to keep so you can license them later

Which business records are deleted by default?

AI developers license operating records: support tickets, chat and email archives, call recordings, work orders, procedures, code, and video of real work. Many of those are deleted automatically, by storage limits, software defaults or routine account clean-up, before anyone thinks to keep them. See what your data is worth first; the free valuation takes company-level answers and no files.

The table shows the defaults documented by common vendors, checked on 6 November 2026. Your plan or settings may differ, so confirm them in your own admin console.

Source: Verkada Help: Common storage questions

Slack retention policy: what to check

On paid plans, Slack keeps data "for the lifetime of your workspace by default", and Workspace Owners can set messages and files to delete after a set time. On the free plan, the choice is 90 days or one year, and data older than one year is deleted on a rolling basis, once a day (Slack). Owners can also let members set retention for individual channels and direct messages.

So the risk on a paid plan is not the default but a later change: an owner shortening retention, members deleting channels, or a downgrade to free. Settle who may change retention, and write it into your policy. If the company is closing or cancelling, export first: Slack, Google Workspace and Microsoft 365 exports before closing.

Source: Slack: Customize data retention in Slack

Google Workspace retention and Vault

By default, Google Workspace data stays in user accounts until the user or an admin deletes it. Google Vault adds retention rules that keep data even if users delete messages and files or empty their trash, and that purge data when a period ends (Google). Google warns that an improperly configured rule can purge data immediately and irreversibly, so test new rules on a small group first (Google).

The bigger default risk is staff turnover. When an admin deletes a user, data that has not been transferred to another user is deleted; some data is kept for 20 days, during which the user can be restored, and then it is unrecoverable (Google). Make data transfer a fixed step in your leaver checklist.

Source: Google Vault: How retention works

Microsoft 365 and Teams retention

Microsoft 365 keeps most content until someone deletes it, but four defaults catch owners out:

• Deleted email is kept in Recoverable Items for 14 days by default, adjustable up to 30 days (Microsoft).
• A deleted user's mailbox is kept soft-deleted for 30 days after the user account is purged, then it is unrecoverable (Microsoft).
• A deleted user's OneDrive is kept for 30 days by default; an admin can change this in the SharePoint admin center (Microsoft).
• Teams meeting recordings and transcripts have a default expiration time of 120 days, and changing the setting only affects new recordings (Microsoft). Teams call logs, by contrast, are retained indefinitely by default (Microsoft).

Source: Microsoft Learn: Manage Teams recording and transcript expiration

CCTV retention period: why footage is gone in about 30 days

Most security cameras record over themselves. Verkada's standard camera has on-camera storage for 30 days of continuously recorded video, with models for 60, 90, 120 and 365 days (Verkada), and when storage fills it overwrites older high-quality video to make room (Verkada).

Do not simply keep everything longer. Footage recorded for security was collected for that purpose, and privacy laws limit reuse and retention. Where you would like to license footage of real work later, such as kitchens, docks, lines or workshops, the better route is a separate, announced recording program with its own notice, and for an archive, exporting the clips that show work rather than people. See selling video footage for physical AI.

If any system creates face or other biometric templates, Illinois law requires a public written retention schedule and destruction when the purpose is met or within 3 years of the person's last interaction, whichever comes first (740 ILCS 14/15).

Source: Verkada Help: Common storage questions

Dashcam footage and call recordings

Fleet dashcams keep footage only on the device until it is overwritten. Samsara says that when storage is full, older footage becomes unavailable because it is overwritten, and overwritten footage cannot be retrieved (Samsara). Motive says video recall is typically limited to up to 30 hours or 7 days, while clips that have been retrieved and uploaded stay on the dashboard with no time limit (Motive). Read your telematics contract too: it governs export and may give the vendor its own rights in the data.

Call recordings are short-lived in many cloud phone systems. RingCentral advertises recordings stored for up to 90 days (RingCentral). Archive them to storage you control if you keep them at all, and only with proper consent: California, for example, makes it an offence to record a confidential communication without the consent of all parties (Penal Code 632). See selling call recordings for AI training.

Source: Samsara Help Center: Vehicle camera video quality and storage

How to set a data retention policy for a small business

A retention policy says, for each type of record, how long you keep it, in what form and who may delete it. It needs a floor (what the law makes you keep) and a ceiling (how long the law lets you keep personal data).

• List every system and record type, with the years held and the admin who controls it. The data inventory template has the columns.
• Set the floor from legal minimums. The IRS says to keep tax records for 3 years in most cases and employment tax records for at least 4 years (IRS); employers covered by EEOC rules keep personnel records for at least one year (29 CFR 1602.14). More are in how long to keep business records.
• Set the ceiling for personal data. The GDPR allows personal data to be kept in identifiable form "for no longer than is necessary" (Article 5(1)(e)), and the UK ICO says not to keep it indefinitely "just in case" (ICO). The CCPA requires businesses to disclose how long they keep each category of personal information and not to keep it longer than reasonably necessary (Civil Code 1798.100).
• Suspend deletion under a legal hold. Once litigation is reasonably anticipated, federal courts can order remedies, and in serious cases sanctions, when a party fails to take reasonable steps to preserve relevant electronic information (FRCP 37(e)). Your policy should say who issues a hold and how it overrides automatic deletion.
• Decide the end-of-period action for each record type: delete, or anonymize and keep. The ICO's own guidance is to erase or anonymise personal data you no longer need, and anonymized records can still be useful.
• Change the defaults in each system to match, and write down who may change them.

Source: ICO: Principle (e) storage limitation

Which records to keep, and in what form

The records most worth keeping are the ones that describe how the company works rather than who its customers are. Keeping them in a form that can be de-identified later costs little now.

Tell staff and customers now, not at the point of sale

The cheapest time to get permissions right is before the records exist. A licence later is much easier if notices already describe the uses.

• Staff: New York requires private employers that monitor employees' phone, email or internet use to give prior written notice on hiring, acknowledged by the employee (Civil Rights Law 52-c). Even where it is not required, a written notice of what is recorded and kept is good practice.
• Customers: update the privacy notice to state retention periods and that records may be de-identified and used or licensed for analysis and AI development. Using personal data for a new purpose needs notice (CCPA) and a lawful basis (GDPR); see GDPR, CCPA and licensing company data.
• Recordings: use announcements and consent that meet the strictest state you operate in.
• Contracts: check client and vendor contracts for clauses that make data the client's or require its deletion at the end of a job.

Source: New York Civil Rights Law 52-c*2: notice of electronic monitoring of employees

Next step

You do not need a buyer to justify a retention policy; it also protects you in disputes and audits. But if the records might be worth licensing, decide now, before the next overwrite or account deletion. See what your data is worth with a free valuation, and if the company is winding down, follow the export checklist before cancelling anything.

Origin Data Partners is an independent data partner and is not affiliated with any AI data buyer. We help owners compare buyers and find the best fit for their records; a buyer may pay Origin when a deal closes. See what your data is worth.