Policy Governance · 18 min read
Records Retention Schedule and Document Retention Policy: A Guide for Growing Businesses
A records retention schedule is the table that tells everyone in a business how long to keep each type of record, from the day it is created to the day it can be safely deleted, and a document retention policy is the short policy that sets the rules the schedule follows. Together they answer two questions an auditor, a regulator or a lawyer will eventually ask: why do you still have this record, and why don’t you have that one?
Most of what ranks for these terms was written for state agencies or by vendors selling storage, so this guide is written for the people who actually build schedules at small and mid-sized companies: an HR lead, a finance manager or an operations head who owns retention on top of a real job. It sits within our wider guide to policy governance, which covers how a growing company decides who writes, approves, owns and reviews every policy.
Key takeaways
- A document retention policy sets the rules once, and the records retention schedule applies them to every type of record, row by row.
- Each row of a schedule names the record series, its owner, the event that starts the clock, the retention period, the legal source and what happens at the end.
- Federal law sets minimum periods for common records, from 1 year for many personnel records to 30 years for employee exposure records, and the longest rule that applies always wins.
- A legal hold stops all destruction of related records, whatever the schedule says, until it is formally released.
- Your policies are records too, so old versions, approvals and acknowledgments need a retention period of their own.
What is a records retention schedule?
A records retention schedule is a list of every type of record your business keeps, grouped into record series, with a retention period and an end-of-life action for each one. A record series is a group of records you create and use together, such as payroll records, signed customer contracts or safety incident reports, and the schedule deals with the series rather than with individual files, so nobody has to make a decision about every document.
A useful schedule is more than a list of legal periods. Many lists that circulate online give you a number for tax records and a number for personnel files, but they don’t say when the clock starts, who decides that a record can go, or what to do when a lawsuit is on the horizon. Those details are what make a schedule something a business can follow and defend, and they are what the rest of this guide covers.
Document retention policy vs records retention schedule
The two terms are often used as if they meant the same thing, but they do different jobs. The document retention policy is a governing policy like your code of conduct: it explains why the business keeps records, who is responsible, how legal holds work and how records are destroyed, and it changes rarely. The schedule is the operational detail that sits underneath it and changes whenever a law, a contract or a business need changes.
Keeping them separate saves a lot of work. Your policy goes through approval and acknowledgment like any other policy, and it stays stable, while the schedule can be updated by the people who own each record series without sending a revised policy to the whole company every time a period changes. A good document retention policy usually covers six things:
- Purpose and scope, including which entities, locations and formats it covers, with email, chat and paper treated the same way.
- Roles, naming who owns the schedule, who owns each record series and who can approve destruction, which works best when it follows the policy owner model you use for every other policy.
- The schedule, attached or linked, with a rule that the longest applicable period wins.
- Legal holds, explaining who can issue one, what it stops and how it is released.
- Destruction, covering approved methods and the log that records what was destroyed, when and by whom.
- Review, setting how often the policy and the schedule are checked against current law.
Why small and mid-sized businesses need a retention schedule
A retention schedule protects a business in two directions at once. Keep records for too short a time and you can’t answer a payroll audit, defend an employment claim or prove what a policy said when an incident happened, and keep them for too long and you pay to store data that only creates risk, because everything you still hold can be requested in a lawsuit or exposed in a breach.
The pressure usually arrives from outside. A customer’s security questionnaire asks whether you have a data retention policy, a certification body asks how you control the retention and disposal of records, a nonprofit board sees the question on Form 990, or a former employee’s lawyer asks for a personnel file you deleted last year. ISO 9001 is a good example, because it treats records as retained documented information and expects you to control their retention and disposition, which in practice means having a schedule and following it.
Sources: ISO 9001:2015 clause 7.5.3, IRS Form 990, Part VI, line 14
For a growing company the best moment to write a schedule is before the first of those requests, because the work is mostly sorting what you already have, and it gets harder with every year of records that pile up in shared drives with no rule attached.
How long should a business keep records? A federal starter table
The table below lists common business records and the minimum periods set by federal law, each read from the regulation or the agency guidance on 26 October 2026. Treat it as a starting point for your own schedule rather than a finished one, because state law, your contracts, your insurers and your industry can all require more.
| Record type | Minimum federal retention period | Where the rule comes from |
|---|---|---|
| Tax returns and the records behind them | 3 years from filing in most cases, 6 years if income was underreported by more than 25%, 7 years for a bad debt or worthless securities claim, and indefinitely if no return or a fraudulent return was filed | IRS record-keeping guidance |
| Employment tax records | At least 4 years after the tax is due or paid, whichever is later | IRS record-keeping guidance |
| Payroll records, pay plans and employment agreements | 3 years | Fair Labor Standards Act, 29 CFR 516.5, and the ADEA, 29 CFR 1627.3 |
| Time cards and wage rate tables | 2 years | Fair Labor Standards Act, 29 CFR 516.6 |
| Personnel records such as applications, promotions and terminations | 1 year from the record or the personnel action, whichever is later, and until the matter is closed if a discrimination charge is filed | Title VII and ADA, 29 CFR 1602.14, and the ADEA, 29 CFR 1627.3 |
| Family and medical leave records | 3 years | FMLA, 29 CFR 825.500 |
| Form I-9 | 3 years after the hire date or 1 year after employment ends, whichever is later | 8 CFR 274a.2 |
| OSHA injury and illness records | 5 years after the end of the calendar year they cover | 29 CFR 1904.33 |
| Employee exposure records | 30 years | 29 CFR 1910.1020 |
| Employee medical records kept under OSHA | Length of employment plus 30 years | 29 CFR 1910.1020 |
| Records behind employee benefit plan filings | At least 6 years after the filing date | ERISA section 107 |
| HIPAA policies, procedures and required documentation | 6 years from creation or the date last in effect, whichever is later | 45 CFR 164.316 and 164.530 |
| Investment adviser books and records | 5 years from the end of the fiscal year of the last entry, including every compliance policy in effect during the last 5 years | Advisers Act, 17 CFR 275.204-2 |
Sources: irs.gov, How long should I keep records, 29 CFR 516.5 and 516.6, 29 CFR 1627.3, 29 CFR 1602.14, 29 CFR 825.500, 8 CFR 274a.2, 29 CFR 1904.33, 29 CFR 1910.1020, 29 U.S.C. 1027, 45 CFR 164.316 and 164.530, 17 CFR 275.204-2
Three rules make the table work in practice. First, when two rules cover the same record, the longer one wins, so payroll records that are also behind your tax filings are kept for the longer tax period. Second, a pending charge, lawsuit or audit extends every related record until it is resolved, which is what the legal hold section below is about. Third, many businesses choose a round business period that is longer than the legal minimum, such as 7 years for financial records, so that one number covers the longest tax case and nobody has to work out which exception applies.
State and local laws often set longer periods for payroll, personnel and medical records, so check the states where you have employees before you finalize each row. This guide is general information rather than legal advice, and your accountant or employment lawyer can confirm the periods that apply to you.
How to build a records retention schedule in eight steps
You don’t need special software to build a schedule, and a well-kept table is enough for most companies under a few hundred people. What you do need is an owner, a few hours with each department and the discipline to write down the reason behind every number.
1. Take an inventory. Sit down with each department and list the records they create and keep, wherever they live: shared drives, email, the HR system, the accounting system, paper files and chat. Ask what they would need to answer a dispute five years from now, because that question surfaces records people forget.
2. Group records into series. Combine records that are created and used together under names your team already uses, such as “payroll records” or “signed customer contracts”, and aim for dozens of series rather than hundreds, because a schedule nobody can read won’t be followed.
3. Find the legal requirement for each series. Start with the federal rules in the table above, add the state rules for every place you employ people, and add industry rules such as HIPAA for healthcare or the books and records rule for investment advisers.
4. Add contract and business needs. Customer contracts, insurance policies, grant agreements and certifications often require records for longer than the law does, and some records are worth keeping simply because the business uses them, such as product designs or board minutes.
5. Set the trigger. Decide the event that starts the clock for each series, such as the date of creation, the last entry, the end of employment, the end of a contract or the end of the tax year, because “keep for 3 years” means nothing until you know 3 years from when.
6. Name an owner. Give each series an owner by role rather than by name, so the schedule survives people leaving, and make that role responsible for applying the period and approving disposal.
7. Decide the disposition. For each series, say what happens when the period ends: secure deletion, shredding, transfer to an archive or a fresh review, and require that every destruction is logged.
8. Approve it, publish it and review it. Put the policy and schedule through the same approval as any other policy, send the policy to everyone it applies to, and set a yearly review so the periods keep up with changes in law and in your business.
The row above is the whole idea in one line. If every row of your schedule answers those six questions, anyone in the business can apply it, and anyone outside it can see that your retention is deliberate rather than accidental.
Legal holds: when the schedule stops
A legal hold, sometimes called a litigation hold, suspends the retention schedule for every record that may be relevant to a lawsuit, audit or investigation that is pending or reasonably expected. The duty to preserve starts when a dispute becomes reasonably foreseeable, which is often before anyone has filed anything, and under the federal rules a court can take measures against a party that lost electronic information it should have preserved.
Source: Federal Rules of Civil Procedure, Rule 37(e)
Your retention policy should explain how a hold works before you need one, in five steps that anyone can follow under pressure.
- Trigger. Say who decides that a hold is needed, usually the CEO or outside counsel, and what events count, such as a demand letter, a regulator’s inquiry or a serious incident.
- Scope. Identify the people, record series, systems and date range the hold covers.
- Notice. Send a written hold notice to every person who holds relevant records, and keep a record that each of them received and acknowledged it.
- Suspension. Stop any scheduled deletion that touches the covered records, including automatic email deletion.
- Release. End the hold in writing when counsel says it is over, then let the normal schedule resume.
The hold notice is itself a document that needs proof of receipt, so some teams send it the same way they send policies, which gives them each custodian’s acknowledgment by name and date without chasing replies in an inbox.
Destroying records in a way you can defend
Destruction is the part of retention most businesses skip, and it is where a schedule proves its worth. A record destroyed on schedule, by an approved method, with a log entry showing what was destroyed, when and on whose approval, is routine housekeeping, while the same record deleted by someone tidying a drive looks like something to hide.
Keep the destruction log simple: the record series, the date range of the records, the method used, the person who approved it and the date it happened. Check for any open legal hold before every destruction run, because a hold always outranks the schedule, and use secure methods such as cross-cut shredding or certified data destruction for anything containing personal or financial information.
Your policies are records too
The record series most schedules forget is the policy program itself. When an employee claims they were never told about a rule, or an auditor asks what your access control policy said last March, the answer depends on records most companies don’t keep on purpose: the version of the policy that was in force, who approved it, and who acknowledged it and when.
Some rules spell this out. HIPAA requires covered entities and business associates to keep their policies, procedures and required documentation for 6 years from the date they were created or last in effect, whichever is later, and investment advisers must keep every compliance policy that was in effect during the last 5 years along with records of their annual review. Even without a rule like that, a policy that has been replaced is evidence of what you expected of people at the time, so it deserves a row in your schedule.
Sources: 45 CFR 164.316(b)(2) and 164.530(j)(2), 17 CFR 275.204-2(a)(17)
For a policy, the record has four parts: every version with its effective dates, the approvals behind each version, the acknowledgments that show who read it, and the audit trail that ties them together. Having been through SOC 2, ISO 9001, ISO 27001 and HIPAA audits, I’ve learned that the version that was in force on a given date is one of the hardest things to reconstruct after the fact, because shared drives keep the latest file and quietly lose the history.
We built AllyMatter to keep that record as a side effect of normal work. Every version of a policy is kept, version compare shows every word removed and added between any two versions, and each policy’s audit trail records its approvals, sends and acknowledgments by name.
A few more details matter for retention. Completed acknowledgments stay on record even after a person leaves and their account is removed, so the proof that a former employee read a policy doesn’t disappear with them. An Admin can set the workspace to Archive Only, so documents are archived and can be restored at any time rather than deleted, and when a document is deleted its history stays in the workspace audit log. An expiry date takes a policy out of view for its audience while its Editor and Admins keep it, which is a clean way to retire a policy without losing the record of it.
The rest of your business records belong in the systems built for them, such as your HR system, your accounting system and your file storage, each following its row of the schedule. Our earlier post on deleting and archiving documents with a full audit trail goes deeper on the archive and delete choice, and our guide to the document audit trail covers what an auditor expects to see.
Keeping the retention policy itself current
A retention policy that nobody has read or reviewed protects nobody, so treat it like the policies it governs. It needs a named owner, an approval before it takes effect, a send to everyone it applies to with an acknowledgment they read it, and a review date, usually once a year, when the owner checks the schedule against changes in law, contracts and systems. Your policy on policies is the natural place to set those rules once for every policy, including this one.
In AllyMatter, each policy carries a review date, either fixed or on a repeating cycle, and a review alert appears on the policy until it is approved again. When the schedule changes in a way that affects everyone, such as a new rule about deleting chat messages, the revised policy goes back through approval and out again for acknowledgment, which is the same yearly cycle we describe in our guide to policy attestation.
Common retention mistakes and how to avoid them
Keeping everything forever. It feels safe, but every record you hold can be requested in a dispute and exposed in a breach, so records past their period are cost and risk with no benefit.
Using a list of legal periods as the schedule. A list of numbers without triggers, owners and disposal rules can’t be applied, and nobody can show that it was.
Forgetting email, chat and personal devices. Retention follows the content of a record rather than its format, so a decision made in chat belongs to the same series as one made on paper.
Deleting without a log. Destruction you can’t show is destruction you can’t defend, so every disposal run needs a dated entry with an approver.
Ignoring legal holds in automated deletion. Automatic email or file deletion keeps running unless someone stops it, which is why the hold procedure must name the systems to pause.
Leaving the policy program out. Old policy versions, approvals and acknowledgments are often the evidence you need most, and they are the records least likely to be on anyone’s schedule.
A retention schedule is one part of a wider compliance program, alongside policies such as a conflict of interest policy, and our guide to policy management software for small and growing businesses explains how the policies themselves are kept approved, read and provable.
Questions about records retention schedules and document retention policies
What is a records retention schedule?
A records retention schedule is a table that lists each type of record a business keeps, how long it must be kept, the event that starts the clock, who is responsible for it, and what happens to it at the end of the period.
What is the difference between a document retention policy and a records retention schedule?
The document retention policy is the short governing policy that says why records are kept, who is responsible and how legal holds and destruction work, while the schedule is the detailed table that applies those rules to each type of record. Most businesses publish the policy and attach the schedule to it.
How long should a small business keep records?
It depends on the record. Federal law sets periods from 1 year for some personnel records to 30 years for employee exposure records, and tax records run from 3 years to indefinitely. Use the longest period that applies to each record type, add any state, contract or industry rule, and write the result into your schedule.
Is a document retention policy required by law?
Most private businesses aren’t required to have a written retention policy, but many laws require you to keep specific records for set periods, and a written policy is how you show you do. Nonprofits are asked on IRS Form 990 whether they have a written document retention and destruction policy.
What is a legal hold?
A legal hold is an instruction to stop destroying records that may be relevant to a lawsuit, audit or investigation that is pending or reasonably expected. It overrides the retention schedule until it is formally released, and failing to preserve relevant electronic information can lead a court to take measures against the business.
How long should we keep old versions of our policies?
Treat superseded policies as records. HIPAA requires covered entities to keep policies and procedures for 6 years from the date they were last in effect, and investment advisers must keep every compliance policy in effect during the last 5 years. Without a rule like that, keep old versions and their acknowledgment records at least as long as a claim about that period could be brought.
Should a retention schedule cover email and chat?
Yes. Retention follows the content of a record, not its format, so an email that approves a contract or records a disciplinary decision belongs to the same record series as the paper version and is kept for the same period.
The pattern behind every retention schedule is the same as the pattern behind every good policy: decide deliberately, write the reason down, assign an owner and keep the proof. Records kept for a reason and destroyed on a schedule are easy to explain, and that is all an auditor, a regulator or a court really wants to see.
Start your 30-day free trial of AllyMatter. No credit card to start, and a 30-day money-back guarantee if you subscribe and change your mind. Free migration.