How to Build a Document Retention Schedule: A Practical Guide
A document retention schedule states what records you keep, for how long, and how you destroy them when the time comes. Without one, businesses drift to one of two extremes: keep everything forever (drowning in storage costs and multiplying the damage of any data breach) or delete things casually (destroying records the law required you to keep). The schedule is the middle path, deliberate, defensible, and consistent.
This guide explains how to use the Document Retention Schedule, what each section captures and the mistakes that cause the most trouble. It is general information, not legal advice. Retention periods are set by law and vary widely by jurisdiction and document type. The schedule is a framework; every period in it must be confirmed against your local requirements.
When to Use This
Build the schedule when records are piling up with no rules, before migrating to digital archiving, when storage costs or audit findings force the issue, or when someone asks “can we delete this?” and nobody knows the answer. It’s also worth building during calm periods rather than in response to litigation, a retention policy created after a dispute starts looks very different from one created as routine governance.
Apply it to both paper and digital records. “Retention” isn’t about filing cabinets; your email archive, cloud drives, and backups are records too, and the schedule should say so explicitly.
How to Fill It Out
Section 1: Record categories. Group records by business function: financial records, tax records, HR and employment records, contracts, correspondence, health and safety records, IT and security logs. One row per record type within each category, “invoices issued”, not just “finance”. Be granular enough that someone can look at a document and find its row without guessing.
Section 2: Retention period. How long each record type is kept, and what triggers the clock, “seven years from the end of the financial year”, “six years after employment ends”, “for the life of the contract plus six years”. Legal requirements come first; business need second. Never invent a period that sounds reasonable, every period should trace back to a law, regulation, or a documented business reason.
Section 3: Legal basis or reference. Note which law or regulation sets each period, or the business reason where no law applies. This is what makes the schedule defensible: a future reviewer, or a regulator, can see why each period was chosen and re-check it. “Legal requirement” without naming the law is not a basis.
Section 4: Storage location and format. Where each record type lives (paper archive, server, cloud service) and any format requirements. Some jurisdictions require original documents for certain records; some accept digital copies only if specific conditions are met. If you’re scanning paper and destroying originals, confirm locally that the scans are legally sufficient first.
Section 5: Destruction method and approval. How records are destroyed at end of life, cross-cut shredding for paper, secure deletion for digital, and who authorises destruction. Build in the most important safeguard: a legal hold procedure. If litigation, investigation, or a regulatory request is reasonably anticipated, relevant records must be preserved regardless of the schedule. Destroying documents under a legal hold can be a serious offence in many jurisdictions. State the hold procedure plainly and make sure the people who handle destruction know it.
Section 6: Owner. Name the person responsible for each record category, the department head or records custodian who ensures the schedule is actually followed. A schedule with no owners is a suggestion, not a policy.
Common Mistakes
1. Using another country’s retention periods. This is the classic error. Retention periods differ enormously between jurisdictions, what’s seven years in one place is ten in another and three somewhere else. Every period must be verified locally. Copying a schedule from a template or another company without checking is how businesses breach the law while believing they’re compliant.
2. No legal hold procedure. The schedule says “destroy after seven years”, so someone destroys, while a dispute is brewing. Normal destruction becomes unlawful destruction the moment litigation is reasonably anticipated. The hold procedure isn’t optional extras; it’s the safety catch the whole schedule depends on.
3. Keeping everything “just in case”. Over-retention feels safe but isn’t: it increases storage costs, multiplies breach exposure (you can’t leak data you no longer hold), and can itself breach data protection principles that require data minimisation. The schedule should be a genuine culling tool, not a rubber stamp for hoarding.
4. A schedule nobody follows. Beautiful document, zero compliance. Assign owners, put destruction reviews on the calendar, and audit occasionally. If departments keep their own shadow archives outside the schedule, fix that, the schedule only works if it covers all records.
Who Needs to Sign Off
A records manager, office manager, or designated responsible person drafts the schedule. Legal counsel reviews every retention period, this is the step that prevents mistake number one. Department heads confirm the categories cover their records and accept ownership. Senior management approves the final schedule formally, including the legal hold procedure. Everyone who handles destruction must be trained on the hold process specifically.
How Often to Review and Update
Review the full schedule annually and immediately whenever relevant laws change. Run destruction reviews on the calendar the schedule sets, quarterly or half-yearly for most businesses. Audit compliance with the schedule itself at least annually: are departments actually destroying on time, are legal holds being applied, are new record types being added? A schedule is a living governance tool, not a one-time project.
Download the free Document Retention Schedule.
Disclaimer: this guide is general information, not legal advice. Document retention periods are set by laws that vary by jurisdiction and document type. Always verify every retention period against your local requirements and get legal advice before finalising your schedule, especially on legal holds and destruction of originals.