# Stop deleting it: which business records to keep so you can license them later

> Data retention policy for small business: default deletion in Slack, Google Workspace, Microsoft 365, CCTV and dashcams, and what to change to keep records.

Canonical: https://origindatapartners.com/guides/keep-company-data-sellable
By: Origin Data Partners
Status: Published
Published: 2026-11-06
Updated: 2026-11-06
Sources checked: 2026-11-06

## Quick answer

Many of the records AI developers license are deleted by default long before anyone asks for them. Standard security cameras keep about 30 days of video before overwriting it, dashcams overwrite footage within hours or days, Microsoft Teams meeting recordings expire after 120 days, and deleting a departed user's Google Workspace account deletes any data not transferred first. Set a written retention policy now: keep company-centric records such as tickets, work orders, procedures, code and chat for as long as the law and your notices allow, export clips and recordings you want before they are overwritten, and anonymize personal data at the end of its retention period instead of keeping it "just in case", which GDPR-style laws do not allow.

## Key points

- Defaults delete more than owners expect: CCTV in about 30 days, dashcam footage in hours or days, Teams meeting recordings in 120 days, departed staff's Google data in 20 days.
- Slack paid plans and Google Workspace keep data by default, until someone deletes it or a user account goes. Check who can change those settings.
- Retention has a floor and a ceiling: tax and employment rules set minimums, and privacy laws such as the GDPR and CCPA cap how long personal data may be kept.
- Keep company-centric records; anonymize personal data at the end of its period instead of deleting the whole record.

## Which business records are deleted by default?

AI developers license operating records: support tickets, chat and email archives, call recordings, work orders, procedures, code, and video of real work. Many of those are deleted automatically, by storage limits, software defaults or routine account clean-up, before anyone thinks to keep them. [See what your data is worth](https://origindatapartners.com/check-fit) first; the free valuation takes company-level answers and no files.

The table shows the defaults documented by common vendors, checked on 6 November 2026. Your plan or settings may differ, so confirm them in your own admin console.

| Record type | Where it lives | Default retention | What to change |
| --- | --- | --- | --- |
| Chat messages and files | [Slack](https://slack.com/help/articles/203457187-Customize-data-retention-in-Slack) | Paid plans: kept for the lifetime of the workspace. Free plan: 90 days or one year, and data older than one year is deleted | Check the workspace and channel retention settings and who may change them; avoid downgrading to free without an export |
| Email, Drive files, Chat | [Google Workspace](https://knowledge.workspace.google.com/vault/retention/how-retention-works) | Kept until the user or an admin deletes it. Deleting a user deletes data not transferred; some is kept for 20 days | Transfer a leaver's data before deleting the account; set Vault retention rules where you have Vault |
| Email (deleted items) | [Microsoft 365 Exchange Online](https://learn.microsoft.com/en-us/exchange/recipients-in-exchange-online/manage-user-mailboxes/change-deleted-item-retention) | Deleted items kept 14 days by default, up to 30 | Use a Microsoft Purview retention policy for anything you must keep |
| Leavers' mailboxes and OneDrive | [Microsoft 365](https://learn.microsoft.com/en-us/sharepoint/retention-and-deletion) | Mailbox recoverable in a soft-deleted state for 30 days, then purged; OneDrive kept 30 days by default | Raise the OneDrive retention for deleted users, or move files before deleting the user |
| Meeting recordings and transcripts | [Microsoft Teams](https://learn.microsoft.com/en-us/microsoftteams/manage-teams-recording-expiration-policy) | Expire after 120 days by default | Change or turn off expiry in the Teams admin center; it only affects new recordings |
| Security camera video | [CCTV and cloud cameras](https://help.verkada.com/verkada-cameras/maintenance-and-troubleshooting/troubleshooting/common-storage-questions) | Standard Verkada cameras hold about 30 days of continuous video; older footage is overwritten | Export clips worth keeping; choose longer retention only where your notices and the law allow |
| Dashcam video | [Fleet dashcams](https://helpcenter.gomotive.com/hc/en-us/articles/6175465640349-Video-Recall-for-Dashcams-and-AI-Omnicams) | Footage on the camera is overwritten as storage fills, typically within 30 hours to 7 days on Motive dashcams | Recall and upload clips soon after an event; uploaded clips stay on the dashboard |
| Call recordings | [Cloud phone systems](https://www.ringcentral.com/features/call-recording) | RingCentral stores recordings for up to 90 days | Archive recordings to storage you control, with the consent the law requires |
| Support tickets | [Zendesk](https://support.zendesk.com/hc/en-us/articles/4408835089050-Viewing-and-recovering-deleted-tickets) | Deleted tickets are permanently removed after 30 days; deletion schedules, if an admin sets them, remove archived tickets (closed more than 120 days) automatically | Check deletion schedules before turning them on; export JSON to keep comments |

Source: [Verkada Help: Common storage questions](https://help.verkada.com/verkada-cameras/maintenance-and-troubleshooting/troubleshooting/common-storage-questions)

## Slack retention policy: what to check

On paid plans, Slack keeps data "for the lifetime of your workspace by default", and Workspace Owners can set messages and files to delete after a set time. On the free plan, the choice is 90 days or one year, and data older than one year is deleted on a rolling basis, once a day ([Slack](https://slack.com/help/articles/203457187-Customize-data-retention-in-Slack)). Owners can also let members set retention for individual channels and direct messages.

So the risk on a paid plan is not the default but a later change: an owner shortening retention, members deleting channels, or a downgrade to free. Settle who may change retention, and write it into your policy. If the company is closing or cancelling, export first: [Slack, Google Workspace and Microsoft 365 exports before closing](https://origindatapartners.com/guides/export-company-records-before-closing).

Source: [Slack: Customize data retention in Slack](https://slack.com/help/articles/203457187-Customize-data-retention-in-Slack)

## Google Workspace retention and Vault

By default, Google Workspace data stays in user accounts until the user or an admin deletes it. Google Vault adds retention rules that keep data even if users delete messages and files or empty their trash, and that purge data when a period ends ([Google](https://knowledge.workspace.google.com/vault/retention/how-retention-works)). Google warns that an improperly configured rule can purge data immediately and irreversibly, so test new rules on a small group first ([Google](https://knowledge.workspace.google.com/vault/retention/retain-drive-files-with-vault)).

The bigger default risk is staff turnover. When an admin deletes a user, data that has not been transferred to another user is deleted; some data is kept for 20 days, during which the user can be restored, and then it is unrecoverable ([Google](https://support.google.com/a/answer/33314)). Make data transfer a fixed step in your leaver checklist.

Source: [Google Vault: How retention works](https://knowledge.workspace.google.com/vault/retention/how-retention-works)

## Microsoft 365 and Teams retention

Microsoft 365 keeps most content until someone deletes it, but four defaults catch owners out:

- Deleted email is kept in Recoverable Items for 14 days by default, adjustable up to 30 days ([Microsoft](https://learn.microsoft.com/en-us/exchange/recipients-in-exchange-online/manage-user-mailboxes/change-deleted-item-retention)).
- A deleted user's mailbox is kept soft-deleted for 30 days after the user account is purged, then it is unrecoverable ([Microsoft](https://learn.microsoft.com/en-us/exchange/recipients-in-exchange-online/delete-or-restore-mailboxes)).
- A deleted user's OneDrive is kept for 30 days by default; an admin can change this in the SharePoint admin center ([Microsoft](https://learn.microsoft.com/en-us/sharepoint/retention-and-deletion)).
- Teams meeting recordings and transcripts have a default expiration time of 120 days, and changing the setting only affects new recordings ([Microsoft](https://learn.microsoft.com/en-us/microsoftteams/manage-teams-recording-expiration-policy)). Teams call logs, by contrast, are retained indefinitely by default ([Microsoft](https://learn.microsoft.com/en-us/purview/retention-policies-teams)).

Source: [Microsoft Learn: Manage Teams recording and transcript expiration](https://learn.microsoft.com/en-us/microsoftteams/manage-teams-recording-expiration-policy)

## CCTV retention period: why footage is gone in about 30 days

Most security cameras record over themselves. Verkada's standard camera has on-camera storage for 30 days of continuously recorded video, with models for 60, 90, 120 and 365 days ([Verkada](https://help.verkada.com/verkada-cameras/maintenance-and-troubleshooting/troubleshooting/common-storage-questions)), and when storage fills it overwrites older high-quality video to make room ([Verkada](https://www.verkada.com/blog/recording-in-adaptive-quality/)).

Do not simply keep everything longer. Footage recorded for security was collected for that purpose, and privacy laws limit reuse and retention. Where you would like to license footage of real work later, such as kitchens, docks, lines or workshops, the better route is a separate, announced recording program with its own notice, and for an archive, exporting the clips that show work rather than people. See [selling video footage for physical AI](https://origindatapartners.com/guides/sell-video-footage-physical-ai).

If any system creates face or other biometric templates, Illinois law requires a public written retention schedule and destruction when the purpose is met or within 3 years of the person's last interaction, whichever comes first ([740 ILCS 14/15](https://www.ilga.gov/legislation/ilcs/fulltext.asp?DocName=074000140K15)).

Source: [Verkada Help: Common storage questions](https://help.verkada.com/verkada-cameras/maintenance-and-troubleshooting/troubleshooting/common-storage-questions)

## Dashcam footage and call recordings

Fleet dashcams keep footage only on the device until it is overwritten. Samsara says that when storage is full, older footage becomes unavailable because it is overwritten, and overwritten footage cannot be retrieved ([Samsara](https://kb.samsara.com/hc/en-us/articles/26015558399501-Vehicle-Camera-Video-Quality-and-Storage)). Motive says video recall is typically limited to up to 30 hours or 7 days, while clips that have been retrieved and uploaded stay on the dashboard with no time limit ([Motive](https://helpcenter.gomotive.com/hc/en-us/articles/6175465640349-Video-Recall-for-Dashcams-and-AI-Omnicams)). Read your telematics contract too: it governs export and may give the vendor its own rights in the data.

Call recordings are short-lived in many cloud phone systems. RingCentral advertises recordings stored for up to 90 days ([RingCentral](https://www.ringcentral.com/features/call-recording)). Archive them to storage you control if you keep them at all, and only with proper consent: California, for example, makes it an offence to record a confidential communication without the consent of all parties ([Penal Code 632](https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=PEN&sectionNum=632)). See [selling call recordings for AI training](https://origindatapartners.com/guides/sell-call-recordings-ai-training).

Source: [Samsara Help Center: Vehicle camera video quality and storage](https://kb.samsara.com/hc/en-us/articles/26015558399501-Vehicle-Camera-Video-Quality-and-Storage)

## How to set a data retention policy for a small business

A retention policy says, for each type of record, how long you keep it, in what form and who may delete it. It needs a floor (what the law makes you keep) and a ceiling (how long the law lets you keep personal data).

- List every system and record type, with the years held and the admin who controls it. The [data inventory template](https://origindatapartners.com/blog/company-data-inventory-template) has the columns.
- Set the floor from legal minimums. The IRS says to keep tax records for 3 years in most cases and employment tax records for at least 4 years ([IRS](https://www.irs.gov/businesses/small-businesses-self-employed/how-long-should-i-keep-records)); employers covered by EEOC rules keep personnel records for at least one year ([29 CFR 1602.14](https://www.law.cornell.edu/cfr/text/29/1602.14)). More are in [how long to keep business records](https://origindatapartners.com/guides/business-records-after-closing).
- Set the ceiling for personal data. The GDPR allows personal data to be kept in identifiable form "for no longer than is necessary" ([Article 5(1)(e)](https://www.legislation.gov.uk/eur/2016/679/article/5/adopted)), and the UK ICO says not to keep it indefinitely "just in case" ([ICO](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-protection-principles/a-guide-to-the-data-protection-principles/storage-limitation/)). The CCPA requires businesses to disclose how long they keep each category of personal information and not to keep it longer than reasonably necessary ([Civil Code 1798.100](https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV&sectionNum=1798.100)).
- Suspend deletion under a legal hold. Once litigation is reasonably anticipated, federal courts can order remedies, and in serious cases sanctions, when a party fails to take reasonable steps to preserve relevant electronic information ([FRCP 37(e)](https://www.law.cornell.edu/rules/frcp/rule_37)). Your policy should say who issues a hold and how it overrides automatic deletion.
- Decide the end-of-period action for each record type: delete, or anonymize and keep. The ICO's own guidance is to erase or anonymise personal data you no longer need, and anonymized records can still be useful.
- Change the defaults in each system to match, and write down who may change them.

Source: [ICO: Principle (e) storage limitation](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-protection-principles/a-guide-to-the-data-protection-principles/storage-limitation/)

## Which records to keep, and in what form

The records most worth keeping are the ones that describe how the company works rather than who its customers are. Keeping them in a form that can be de-identified later costs little now.

| Record | Keep it as | Why it matters later |
| --- | --- | --- |
| Support tickets and chat threads | Full history with comments, in a JSON or native export | Problems, answers and outcomes in sequence |
| Work orders, job notes and photos | Linked to the job, with dates and results | What was found, what was done and whether it worked |
| Procedures, checklists and training material | Every version, with dates | How the work is meant to be done, and how that changed |
| Source code and tickets | Repository history, not just the latest snapshot | How the software was built and fixed |
| Call recordings | Archived with the consent record, only where consent covers it | Real conversations with outcomes |
| Video of real work | Clips exported from security or dashcam systems, or footage from an announced program | Demonstrations of physical tasks |
| Personal details inside all of the above | Anonymized or pseudonymized at the end of their retention period | Keeps the record useful without keeping the person |


## Tell staff and customers now, not at the point of sale

The cheapest time to get permissions right is before the records exist. A licence later is much easier if notices already describe the uses.

- Staff: New York requires private employers that monitor employees' phone, email or internet use to give prior written notice on hiring, acknowledged by the employee ([Civil Rights Law 52-c](https://www.nysenate.gov/legislation/laws/CVR/52-C*2)). Even where it is not required, a written notice of what is recorded and kept is good practice.
- Customers: update the privacy notice to state retention periods and that records may be de-identified and used or licensed for analysis and AI development. Using personal data for a new purpose needs notice (CCPA) and a lawful basis (GDPR); see [GDPR, CCPA and licensing company data](https://origindatapartners.com/guides/data-licensing-gdpr-ccpa).
- Recordings: use announcements and consent that meet the strictest state you operate in.
- Contracts: check client and vendor contracts for clauses that make data the client's or require its deletion at the end of a job.

Source: [New York Civil Rights Law 52-c*2: notice of electronic monitoring of employees](https://www.nysenate.gov/legislation/laws/CVR/52-C*2)

## Next step

You do not need a buyer to justify a retention policy; it also protects you in disputes and audits. But if the records might be worth licensing, decide now, before the next overwrite or account deletion. [See what your data is worth](https://origindatapartners.com/check-fit) with a free valuation, and if the company is winding down, follow [the export checklist](https://origindatapartners.com/guides/export-company-records-before-closing) before cancelling anything.

Origin Data Partners is an independent data partner and is not affiliated with any AI data buyer. We help owners compare buyers and find the best fit for their records; a buyer may pay Origin when a deal closes. [See what your data is worth](https://origindatapartners.com/check-fit).


## Questions and answers

### What is a data retention policy?

A written rule, for each type of record, on how long the company keeps it, in what form, who may delete it and what happens at the end, such as deletion or anonymization. It sets a minimum from tax, employment and industry rules and a maximum for personal data under privacy laws, and says how a legal hold stops automatic deletion.

### How long should a small business keep records?

It depends on the record. The IRS says to keep tax records for 3 years in most cases and employment tax records for at least 4 years, and employers covered by EEOC rules keep personnel records for at least one year. Personal data should not be kept longer than needed for its purpose, so set each period separately.

### What is Slack's default retention policy?

On paid plans, Slack keeps messages and files for the lifetime of the workspace by default, unless an owner sets a shorter period. On the free plan, retention is 90 days or one year, and data older than one year is deleted on a rolling basis.

### Does Google Workspace delete data automatically?

Not by default: data stays in user accounts until the user or an admin deletes it, unless Vault retention rules say otherwise. But deleting a user deletes any data not transferred to another user, with some data recoverable for 20 days.

### How long is CCTV footage kept?

Typically around 30 days before it is overwritten. Verkada's standard cameras store about 30 days of continuous video, with models for 60 to 365 days, and older footage is overwritten as storage fills. Privacy laws limit how long and for what purposes you may keep footage of people.

### How long do dashcams keep footage?

Only until storage fills, often hours to days. Motive says video recall is typically limited to up to 30 hours or 7 days, and Samsara says older footage is overwritten when storage is full and cannot be retrieved. Clips you recall and upload stay available.

### Do Teams meeting recordings expire?

Yes. Microsoft Teams meeting recordings and transcripts have a default expiration time of 120 days. An admin can change or turn off expiry in the Teams admin center, but the change only applies to new recordings.

### Can I keep customer data just in case I sell it later?

Not as personal data under GDPR-style laws. The GDPR allows identifiable data to be kept no longer than necessary for its purpose, and the UK ICO says not to keep it indefinitely just in case. Keep company-centric records, and anonymize personal details at the end of their retention period.

### What is a legal hold?

An instruction to stop deleting records that may be relevant to a lawsuit or investigation, overriding normal retention. Federal courts can order remedies, and in serious cases sanctions, when a party fails to take reasonable steps to preserve electronic information that should have been kept once litigation was anticipated.

## Sources

- [Slack: Customize data retention in Slack](https://slack.com/help/articles/203457187-Customize-data-retention-in-Slack)
- [Google Vault: How retention works](https://knowledge.workspace.google.com/vault/retention/how-retention-works)
- [Google Vault: Retain Drive files with Vault](https://knowledge.workspace.google.com/vault/retention/retain-drive-files-with-vault)
- [Google Workspace Admin Help: Delete or remove a user from your organization](https://support.google.com/a/answer/33314)
- [Microsoft Learn: Change how long permanently deleted items are kept in an Exchange Online mailbox](https://learn.microsoft.com/en-us/exchange/recipients-in-exchange-online/manage-user-mailboxes/change-deleted-item-retention)
- [Microsoft Learn: Delete or restore user mailboxes in Exchange Online](https://learn.microsoft.com/en-us/exchange/recipients-in-exchange-online/delete-or-restore-mailboxes)
- [Microsoft Learn: OneDrive retention and deletion](https://learn.microsoft.com/en-us/sharepoint/retention-and-deletion)
- [Microsoft Learn: Manage Teams recording and transcript expiration](https://learn.microsoft.com/en-us/microsoftteams/manage-teams-recording-expiration-policy)
- [Microsoft Learn: Learn about retention for Microsoft Teams](https://learn.microsoft.com/en-us/purview/retention-policies-teams)
- [Verkada Help: Common storage questions](https://help.verkada.com/verkada-cameras/maintenance-and-troubleshooting/troubleshooting/common-storage-questions)
- [Verkada: Recording in adaptive quality](https://www.verkada.com/blog/recording-in-adaptive-quality/)
- [Samsara Help Center: Vehicle camera video quality and storage](https://kb.samsara.com/hc/en-us/articles/26015558399501-Vehicle-Camera-Video-Quality-and-Storage)
- [Motive Help Center: Video recall for dashcams and AI Omnicams](https://helpcenter.gomotive.com/hc/en-us/articles/6175465640349-Video-Recall-for-Dashcams-and-AI-Omnicams)
- [RingCentral: Call recording features](https://www.ringcentral.com/features/call-recording)
- [Zendesk: Viewing and recovering deleted tickets](https://support.zendesk.com/hc/en-us/articles/4408835089050-Viewing-and-recovering-deleted-tickets)
- [Zendesk: Creating ticket deletion schedules](https://support.zendesk.com/hc/en-us/articles/6388012977306-Creating-ticket-deletion-schedules)
- [GDPR (Regulation (EU) 2016/679) Article 5 as adopted, on legislation.gov.uk](https://www.legislation.gov.uk/eur/2016/679/article/5/adopted)
- [ICO: Principle (e) storage limitation](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-protection-principles/a-guide-to-the-data-protection-principles/storage-limitation/)
- [California Civil Code 1798.100 (CCPA notice at collection, including retention periods)](https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV&sectionNum=1798.100)
- [Illinois Biometric Information Privacy Act, 740 ILCS 14/15](https://www.ilga.gov/legislation/ilcs/fulltext.asp?DocName=074000140K15)
- [Federal Rules of Civil Procedure, Rule 37(e): failure to preserve electronically stored information](https://www.law.cornell.edu/rules/frcp/rule_37)
- [New York Civil Rights Law 52-c*2: notice of electronic monitoring of employees](https://www.nysenate.gov/legislation/laws/CVR/52-C*2)
- [California Penal Code 632: recording confidential communications](https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=PEN&sectionNum=632)
- [IRS: How long should I keep records?](https://www.irs.gov/businesses/small-businesses-self-employed/how-long-should-i-keep-records)
- [29 CFR 1602.14: preservation of employment records](https://www.law.cornell.edu/cfr/text/29/1602.14)

## Related reading

- [Cancel Google Workspace or delete Slack? Export data first](https://origindatapartners.com/guides/export-company-records-before-closing)
- [How long to keep business records: keep, destroy or license](https://origindatapartners.com/guides/business-records-after-closing)
- [/blog/company-data-inventory-template](https://origindatapartners.com/blog/company-data-inventory-template)
- [Can a company sell its Slack and email archives for AI training?](https://origindatapartners.com/guides/sell-slack-email-archives-ai-training)
- [Can a company sell its video footage to AI and robotics companies?](https://origindatapartners.com/guides/sell-video-footage-physical-ai)
- [Anonymization vs pseudonymization: GDPR rules and examples](https://origindatapartners.com/guides/anonymization-vs-pseudonymization)