Skip to content

28 July 2026

Written by , Founder

How long should a business keep its commercial documents?

Longer than you think for some classes and far shorter than you are keeping them for most, and the point of a schedule is that nobody has to decide case by case.

Almost every business keeps everything forever, in several places, and nobody has ever decided to. It is not a policy. It is the absence of one. Deleting something requires a person to take responsibility for deleting it, and in the absence of a schedule that says otherwise, nobody ever will.

The cost is quiet and compounding. Storage is the smallest part of it. The real cost is that every future search is slower, every future inventory is larger, and personal information sits in systems long after any reason to hold it has passed.

What a retention schedule actually is

One row per document class, with four things against each:

PeriodHow long it is kept, and from what event: signing, termination, last transaction
BasisWhy that period. The column everybody omits
OwnerA named role responsible for applying it
MethodOrdinary deletion, secure destruction, or archive rather than dispose

Classes, not documents. "Customer contracts", not each contract. A schedule that operates at document level is a schedule nobody operates.

The basis column is the whole thing

A retention period with no recorded reason is a number nobody will trust in three years, and the first person to question it will win by default.

The basis might be a statutory minimum, a limitation period, a contractual obligation, or a commercial judgement about how long the business might need the record. All four are legitimate. What matters is that the reason is written down beside the period, so that when somebody asks why customer contracts are kept for seven years after termination there is an answer that is not "that is what we have always done".

Where no basis has been established, the row says "not determined" rather than carrying a plausible-looking number. An invented period is worse than an obvious gap, because the gap prompts somebody to fix it.

Personal information is its own category

Any class holding personal information should be identified separately and given its own disposal method, because the calculation is different. For most records, holding them longer is inefficient. For personal information, holding them longer than necessary is itself the problem, and a security incident in year six exposes data the business had no remaining reason to hold.

Identify those classes first, and treat their periods as the ones most worth getting properly advised on.

The first-pass list

Once the schedule exists, produce the list of what is already past its period. This is usually a substantial quantity and it is the thing that makes the schedule feel real.

It is a list, not an action. Before anything is disposed of, somebody has to confirm that nothing on it is subject to a legal hold: an actual or anticipated dispute, an investigation, an audit. Disposing of records that are subject to a hold is materially worse than keeping them too long, and the check takes an afternoon.

Where the schedule will fail

Personal email. The hardest class to apply any schedule to, and usually the one holding the most. Name it explicitly rather than pretending the shared drive is the whole picture.

Systems nobody listed. The old CRM, the departed employee's drive, the backup nobody has looked at since the migration. The inventory step is where these surface, and they surface only if you ask what systems exist rather than what documents exist.

Nobody applying it. A schedule with an owner named by role, a review trigger and a place in somebody's actual routine gets applied. One that lives in a policy folder does not.

The order to do it in

Inventory the classes and the systems. Get the periods and their bases determined. That is advice work, and it is the input to the schedule rather than its output. Assign owners and methods. Produce the first-pass list. Write the instructions and set the review trigger.

Doing it in that order takes a few weeks. Doing it in any other order produces a document that looks like a retention schedule and is never used.

The boundary

Inventorying the classes, building the schedule, assigning owners and producing the first-pass list is filing work, and it is work a business can do for itself.

How long any class must be kept, what obligations attach to personal information, and whether a legal hold applies are questions for your own external adviser. That is the basis column, and it is an input to the schedule rather than something the schedule produces.

Which is why the inventory comes first. A question that begins "here are our nineteen document classes and the systems they sit in, which periods apply" is bounded. The same question without the inventory starts with somebody working out what the business holds.

The engagement

Retention and disposal schedule

A schedule covering every document class the business holds, with a retention period, an owner and a disposal method against each.

What the engagement covers

from$2,600fixed after scopingex GST

Keep reading

Other questions