Glossary term
Data Retention Schedule
Subject: Technology, Cyber and Data, IT and Data Governance
Also known as: Retention policy, Retention schedule
A data retention schedule is a document listing each type of record or data the organisation holds, how long it must be kept, the reason, and what happens when that period ends.
Explanation
Keeping everything forever is costly and risky, while deleting too early can break the law or destroy evidence. The schedule resolves this by setting a period for each record class, such as customer files, payroll, contracts or CCTV footage. Periods come from legal and regulatory requirements, tax and accounting rules, contract terms, and business need, and the longest valid reason usually applies. The schedule also states the owner, the format, where the record lives and the disposal method, such as secure deletion or anonymisation. A legal hold overrides it when litigation or an investigation is expected, suspending deletion for the relevant records. Privacy laws push for the shortest justified period, while financial regulation often requires years of preservation, so legal advice is needed to settle conflicts. Auditors check that deletion actually happens as written, including in backups and cloud copies.
Example
A pharmaceutical manufacturer sets retention periods for batch records, clinical correspondence and employee files. When a batch record reaches the end of its period, the system flags it to the owner. Legal confirms no dispute is pending, and the record is destroyed with a certificate of disposal.
Not to be confused with
- Backup policy
- A backup policy governs copies kept for recovery after failure; the retention schedule governs how long the records themselves must be kept.