How Long Should You Keep That? A Plain Guide to Data Retention Policy

For many small offices, the real retention policy is "we never delete anything." It feels safer than the alternative. It usually is not. Every file kept past its useful life adds no benefit and one more thing that can leak, be lost with a laptop, or need to be disclosed after an incident.

Start with the question a policy answers

The question is not "how long can we keep this?" but "how long do we need to?" Some records have a defensible multi-year answer set by tax, employment or health-care rules. A scanned intake form with a Social Security number on it, years after the engagement ended, often does not. The right periods depend on your profession and state, so ask your attorney, accountant or professional association for the current requirements. This is general education, not legal advice.

A simple framework

1. Legal and contractual minimums first. Find the minimum period each rule requires for each type of record; if several rules apply, use the longest. Never go shorter.
2. Business need second. Beyond the minimum, keep a record only if you can name the reason: an active client, an open dispute, a recurring filing.
3. Everything else gets an end date. Old exports, superseded drafts, one-off reports and duplicate copies should expire on a schedule, not live indefinitely.
4. Decide where the official copy lives. Retention is easy when there is one home for each record and hard when copies are scattered across desktops.

A one-page retention table

You do not need software to start. Make a small table with four columns: type of record, where the official copy lives, how long you keep it, and who is responsible for disposal. For example, a hypothetical accounting office might list client tax workpapers, payroll records, engagement letters, scanned client IDs and routine email attachments, each with its own period and owner. The exercise often reveals that the riskiest items, such as scanned IDs and copied spreadsheets, have no real home at all.

Policy without enforcement is just a document

Choosing a period is the easy part. The hard part is finding and removing data that has passed it, across every laptop and not only the file server. That is where most policies quietly fail: nobody goes back to look, and copies keep multiplying through downloads, exports and email attachments.

Where a scan helps, and where it does not

MyVaultMate deletes nothing on its own, and it cannot tell you how old a record's business purpose is. What it does is show you where sensitive data currently sits. Scheduled scans of local drives, synced cloud folders and external disks produce a list of files containing Social Security numbers, payment card numbers, labeled identification values or health-related keywords, with the file path and severity. After the first full scan, later scans can be incremental and re-read only changed files, so checking regularly is not heavy. You compare the list against your retention table, then your staff or IT provider moves, encrypts or removes what no longer belongs. A re-scan then shows whether the list shrank, and the dashboard totals update to match; compare them with your first saved report.

Remember the limits: RTF and PowerPoint files, Outlook .pst data files and zip archives are not scanned yet, pictures, videos, recordings and scanned PDFs are not read (each counts at 70), and detection is rule-based, so review findings before acting.

What to do this week

• Draft the four-column table for your five most common record types.
• Pick one low-risk category, such as old exports, and set its end date.
• Choose a monthly or quarterly date to review what the scan reports against the table.
• Tell staff the new rule in one sentence, and where the official copy lives.

You can see what a report looks like at /sample, or start a 14-day trial at /trial/ (a card is required and never charged automatically: the 14 days start at your first computer, and you choose a plan when they end).