Data Retention Policies: Deciding What to Keep Before Somebody Asks For It
TL;DR:
A data retention policy is a written decision about how long each kind of record lives, and what happens to it at the end.
Think of it like a storage unit you have been renting for a decade. Nobody ever decided to keep the boxes. Nobody decided to throw them out either, so the rent just keeps going out every month. Then one day somebody asks what is in there, and now you have to look in all of it.
On a good day a retention policy is invisible bookkeeping. On a bad day it is the difference between handing over two years of email because that is your documented schedule, and handing over eleven because you never had one.
Beyond the Basics:
Here's the shift: storage got cheap enough that nobody had to decide, and "keep everything" quietly became the policy at most businesses.
The cost is not really the storage bill. It is that every record you hold is a record you may have to search, produce, or disclose after a breach. Data you deleted on a documented schedule two years ago cannot be stolen, subpoenaed, or leaked. That is the whole argument for having a schedule at all.
- Inventory what you actually hold. Mail, files, chat, CRM records, backups, and the departed employee's mailbox nobody closed. Most inventories surprise the people who commissioned them.
- Group records into a handful of classes. Financial, employment, customer contracts, general correspondence. Per-file decisions do not survive contact with reality; four or five buckets do.
- Assign a period to each class, and write down why. The reason matters more than the number, because a schedule you can explain is defensible and an arbitrary one is not.
- Automate the deletion, and prove it ran. A policy nobody enforces is worse than none, because now you have documented a rule you are visibly ignoring.
Retention periods come from three places, and they conflict: regulation that sets a floor, contracts that sometimes set their own, and privacy law that pushes toward keeping less. Where they collide, the longest applicable floor usually wins. Get the specific numbers for your industry from counsel rather than a blog post, including this one.
In a Microsoft environment this runs through Purview retention labels and policies, applied across Exchange, SharePoint, OneDrive, and Teams, with the option to make deletion automatic rather than a chore somebody remembers.
Here's the catch: legal hold overrides everything. The moment litigation is reasonably anticipated, deletion for the affected material has to stop, and automated cleanup deleting on schedule during a hold is its own serious problem. Build the hold switch at the same time as the schedule, not afterwards.