Most small companies keep everything. Old invoices, applications from people who were never hired, exports from systems nobody uses any more, email attachments from ten years ago. Nobody decided this. Nobody decided the opposite either.
Keeping everything has a cost. Files are hard to find, a leaked archive exposes far more than it should, and when a customer asks what you hold about them, nobody can answer. A retention schedule gives you a simple answer to the question "how long do we keep this, and who decides?"
What a retention schedule is
It is one table, ideally one page. For each type of business record it says how long you keep it, who owns it and when it gets deleted. It is not a policy document with thirty pages, and it does not need special software. A shared spreadsheet is fine.
The table
Use these columns:
| Record type | Where it lives | Keep for | Reason | Owner | Action at the end |
|---|---|---|---|---|---|
| Issued invoices | Accounting system | Legal minimum (ask your accountant) | Tax and accounting rules | Finance lead | Delete or archive |
| Signed customer contracts | Shared drive, folder Contracts | Contract end plus a set period | Possible disputes | Operations lead | Delete |
| Job applications, not hired | Email and HR folder | A few months | No further need | HR contact | Delete |
| Customer support emails | Shared mailbox | One to two years | Service quality | Support lead | Delete |
| Project files of finished work | Shared drive | Agreed period after handover | Warranty and follow-up work | Project owner | Archive, then delete |
The periods in this example are placeholders. Yours depend on your country, your industry and your contracts.
Step 1: list the record types
Spend one hour with the person who runs each area, such as finance, HR, sales and operations. Ask them one question: "What do you store that we might be asked about, or that would hurt if it leaked?" Aim for 10 to 20 record types, not 100. Group similar things. "Customer emails" is one row, not one row per customer.
Step 2: set the retention times
For records that the law covers, such as accounting documents and payroll, ask your accountant or lawyer for the minimum and write it down with the reason. Do not copy times from a blog post, including this one, because the rules differ by country.
For everything else, choose a period you can explain in one sentence: "We keep it as long as it can still help us in a dispute or in repeat work." When in doubt, pick a shorter period and a clear rule for extending it, rather than "forever".
Step 3: name an owner for each row
The owner is a person, not a department. They know what the records are, they confirm each year that deletion can go ahead, and they handle the exceptions. One owner can hold several rows. If a row has no owner, nobody will ever delete anything.
Step 4: fix one deletion day a year
Choose a date, for example the first working Tuesday of February, and put it in the shared calendar. On that day each owner:
- Opens the table and checks which records have passed their period.
- Checks the exceptions list (see below).
- Deletes the records, or confirms the archive, and writes the date in the table.
An hour per owner is usually enough once the table exists. A single fixed day works better than "whenever we have time", because it never happens in the second case.
Remember the copies
Deleting the original is not enough. Records also sit in backups, exports, email attachments and on laptops. For each row, note where copies may exist and how they disappear. Backups often expire on their own after a set number of days, so a note "backup rotates after 90 days" may be all you need. Customer data held in an AI tool needs the same care; see data handling and retention for customer data in AI agents.
Exceptions that pause deletion
Add a short section below the table: deletion is paused for any record that is part of a dispute, a complaint, an audit or an official request. Name who may declare such a pause, usually the managing director, and who lifts it. Write down the date and the reason.
Link it to the rest of your routines
- When someone leaves, their mailbox and files follow the table too. Add this to the new employee access checklist.
- Check who can see which records at the same time as the quarterly access review.
- Before the first deletion day, tidy obvious doubles; the duplicate records cleanup shows a simple way.
Common mistakes
- Writing a long policy that nobody reads instead of one table.
- Guessing legal minimums instead of asking.
- Rows without a named owner.
- No fixed date, so deletion never happens.
- Deleting the original but forgetting backups and exports.
- No rule for pausing deletion during a dispute.
Summary
A retention schedule is one table: record type, where it lives, how long you keep it, who owns it and what happens at the end. Take legal minimums from your accountant or lawyer, name an owner for each row, pick one deletion day a year and write down the exceptions. After the first round you will know what you hold and why.
Sources
- Our related articles linked above.
- The approach described here is common practice for small and mid-sized companies, used as a practical guide and not as legal advice. Legal retention periods differ by country and record type, so confirm them with your accountant or lawyer. No client results or market figures are claimed in this article.
