Building a records retention schedule

Old data is a liability with no upside. Every extra year of client files in a mailbox is more to expose in a breach, more to notify about, more to search and review in litigation, and more to protect. PIPEDA's Schedule 1 principles say personal information should be kept only as long as necessary to fulfil the purposes for which it was collected, and should be destroyed, erased or made anonymous once it is no longer needed.

A schedule also protects you from the opposite problem: deleting something you were legally required to keep.

Start with the rules that set floors. The Canada Revenue Agency generally requires records and supporting documents to be kept for six years from the end of the last tax year they relate to, and some records, such as those on certain long-term assets and corporate records, need to be kept longer. Beyond tax, look at employment standards, sector regulators (health, financial services, professional bodies), contracts with clients, insurance policy terms and limitation periods for potential claims.

Then add business need: how long do you genuinely refer back to a closed project, a former client file or an old proposal?

Keep categories broad enough that staff can apply them without a manual. Ten to twenty categories covers most small and mid-sized organizations.

Each category needs a period and a trigger event: 'seven years after the file closes', not just 'seven years'. Event-based triggers matter because a client relationship can run for a decade; counting from the creation date would delete records you still need. Note who owns each category and the legal source for the period, so the schedule can be defended and updated.

1. 01

   Destroy securely

   Shred paper; for electronic records, delete from systems and let backups age out on a known cycle. Wipe or physically destroy retired drives.

2. 02

   Record destruction

   Keep a log of what categories were destroyed and when, without keeping the content.

3. 03

   Suspend for holds

   When litigation, an investigation or a regulatory inquiry is reasonably anticipated, relevant records must be preserved regardless of the schedule. Holds override retention.

4. 04

   Release holds

   When counsel confirms the matter is over, release the hold so normal retention resumes.

A schedule nobody enforces is a document, not a control. In Microsoft 365, Microsoft Purview retention policies apply broad rules to locations such as Exchange mailboxes, SharePoint sites, OneDrive accounts and Teams, while retention labels let specific items or libraries carry a category's period. In Google Workspace, Google Vault provides retention rules and holds. Both can keep and then delete content automatically, and both let holds override deletion.

Roll out carefully: start by retaining, confirm the categories map correctly, then switch on deletion for the categories you are sure about. We help organizations turn a schedule into tested retention settings.