Business Data Retention Is a Decision, Not a Storage Setting

Storage is available, so the company keeps the records. A customer asks why old information remains. A legal matter requires preservation. A system migration creates another copy. Nobody can say which rule applies to which data or who can authorize its deletion.

Business data retention governance turns those competing needs into explicit decisions. The business must know why it keeps a category of information, what duties apply, when the retention period starts and how an authorized deletion is verified.

The answer is not delete everything or retain everything. It is a documented, counsel-reviewed rule that the organization can operate across its systems, suppliers and working copies.

Key takeaways

• Start with a category, purpose and accountable business owner rather than a single company-wide number of years.

• Have counsel assess applicable recordkeeping, contractual and preservation requirements.

• Define the event that starts the period; creation, account closure and contract termination are not interchangeable.

• Holds and exceptions need a controlled route that stops deletion where required.

• Deletion is an operating process with evidence, not only a policy statement.

Step 1: Identify what the information is for

Group records by a meaningful business category and purpose. A customer account record, a tax record, a support transcript and a security log may have different needs even if they sit in the same platform.

Identify the owner who can explain why the category is retained. Map the main systems, exports and service providers that hold it. Avoid a register so detailed nobody can maintain it, but do not use broad labels that conceal different duties.

The FTC's business guidance recommends keeping sensitive personal information only where there is a legitimate need and using a written retention policy when information must be kept for business or legal reasons. That is a useful starting principle, not a universal retention schedule.

Step 2: Reconcile business needs with applicable duties

Ask counsel and relevant specialists to determine the requirements for the category, jurisdiction, business and transaction. Include recordkeeping obligations, contractual commitments, privacy duties, limitation issues and preservation needs as applicable.

A business preference does not override a legal duty. Nor does a general desire to be cautious establish that indefinite retention is lawful or appropriate. Record the basis for the selected rule and the questions still open.

Do not borrow a retention period from another company without checking its context. The same type of file can support different purposes and duties in different organizations.

Step 3: Define the trigger, hold and exception route

A period without a starting event is not an executable rule. Specify what starts the clock and which system supplies the event. Check whether downstream copies receive that signal.

Create a controlled process for a legal hold or another justified exception. Define who can issue it, what it covers, how affected systems and custodians are notified and who can release it. Counsel should direct preservation decisions for the relevant matter.

Do not let a deletion job make that judgment on its own. Equally, do not let an old hold remain unreviewed simply because nobody owns the release process.

Step 4: Test deletion across the actual data path

Choose an approved category and a safe test. Confirm that the system identifies eligible records correctly, respects holds and produces the expected evidence. Use authorized test data where possible.

Trace exports, reporting stores and service-provider copies. Understand how backups age out or are handled on restoration, and document limitations rather than promising immediate removal from every medium. Ask suppliers for evidence relevant to the agreed deletion obligations.

A deletion log can establish that a job ran. It may not establish that every intended record or copy was covered. Match the verification to the claim being made.

Step 5: Report unresolved retention decisions as business risk

Useful reporting shows categories without an approved rule, holds that lack ownership, failed deletion jobs and suppliers whose arrangements remain unclear. Tie each gap to an owner, consequence and next decision.

Keep the scope and evidence visible, as in board-focused third-party risk reporting. A percentage of records deleted is difficult to interpret without knowing whether those records were eligible and whether preservation restrictions were honored.

The board should understand whether management can explain and operate material retention decisions. It should not be asked to choose a technical storage setting in place of the legal and business analysis.

A category-level retention decision register

This is an illustrative worksheet, not a legal schedule. It deliberately supplies no universal number of years.

Decision field	What to record	Evidence or review question
Category and purpose	Defined records and the business use they support.	Can the owner explain why retention is needed?
Rule and basis	Approved period, applicable duties and counsel's relevant assessment.	Does the rule fit this entity, jurisdiction and use?
Starting event	The specific event that begins the period.	Which reliable system produces that event?
Hold or exception	Authority, affected scope and review or release route.	Will scheduled deletion respect the current restriction?
Systems and suppliers	Primary stores, exports, backups and provider arrangements.	Where can a copy remain after the main record is removed?
Disposal and evidence	Approved method, operating owner and verification record.	What establishes that the intended action occurred?

Review the register when the purpose, system, law, contract or processing arrangement changes. A rule that was appropriate before a new use may need reassessment.

Sources

FTC, Protecting Personal Information: A Guide for Business, Scale Down and Pitch It sections. The register and testing workflow are practical recommendations. They do not determine any organization's legal retention period or preservation obligations.

Frequently asked questions

How long should a company retain customer data?

There is no universal period. The answer depends on the category, purpose, applicable law, contracts and preservation needs. Establish the rule with counsel and the business owner, including the starting event and deletion process.

Does a legal hold cancel the retention policy?

It can suspend the ordinary disposal rule for the material within its scope. The organization needs a controlled process to apply, review and release the restriction under counsel's direction. Other records may still follow their normal rules.

Are backups exempt from retention governance?

They still need to be understood. The appropriate treatment depends on the system, purpose and applicable obligations. Document backup lifecycle, access and restoration behavior, and avoid an unsupported promise of immediate deletion from every copy.

Is a written policy enough?

No. The organization needs owners, system rules, hold handling, supplier arrangements and evidence that the process works. A policy can state the decision; it cannot prove execution.

Closing

Pick one material data category and follow it from business purpose to eventual disposal. If the team cannot explain the rule, the trigger, the hold path and the evidence of deletion, the next step is a decision record, not more storage.