Records Retention & Legal Holds

Draft status and purpose

This public draft is pending management and legal approval; it is not currently adopted and provides no certification or compliance guarantee.

The proposed Standard is intended to make records available when needed, reduce unnecessary accumulation, and support lawful, consistent disposal. It is not a promise that every record will be preserved indefinitely, and it does not replace legal advice, a contract, a tax rule, a privacy obligation, or a litigation-specific instruction.

Scope and records categories

Upon adoption, the Standard would cover records created or received in company business, regardless of format or location, including paper, email, messages, documents, databases, tickets, logs, financial materials, contracts, personnel materials, customer and project records, security records, and governance records.

Management should establish a schedule with categories that reflect the record's purpose and applicable legal, tax, regulatory, contractual, operational, privacy, and evidentiary needs. Categories may include accounting and tax, contracts and procurement, personnel, customer and delivery, security and incidents, intellectual property, corporate governance, and legal matters.

There is no single universal retention period for all records. A category-specific schedule should state the event that starts a retention period, the responsible system or owner, the authorized disposition, and any rule that requires longer preservation. A record should not be disposed of merely because it is old if another applicable requirement or a legal hold requires preservation.

Proposed schedule governance

Upon adoption, management should designate a proposed records owner and people responsible for legal review, business categories, and technical implementation. The proposed owner should maintain the schedule, version its changes, document the rationale and source for each category, and make the current version available to people who handle records.

Category owners should identify authoritative records, duplicate or convenience copies, storage locations, access needs, disposition methods, and dependencies. Legal review should occur when a category implicates a claim, investigation, regulatory requirement, privacy right, contract, or uncertainty about the appropriate period.

Changes to the schedule should be approved and documented before automated disposal is changed. Exceptions should identify the category, reason, duration or event, approving authority designated by management, and any compensating handling instruction. No exception may release or narrow a legal hold.

Storage, access, and disposition controls

Records should be stored in an authoritative location with appropriate access restrictions, reliable timestamps, version or integrity information where needed, and enough metadata to identify the category and disposition event. People should avoid using personal storage or untracked channels as the authoritative record location.

The proposed owner and system administrators should map automated deletion, archival, backup rotation, and account offboarding processes to the category schedule. Disposal should be authorized, logged, and appropriate to the medium and sensitivity; records needed for business, audit, investigation, or legal purposes must be preserved instead.

Access should follow the business need and be reviewed when a person changes duties or leaves. Copies should be minimized where practical, but routine cleanup must not alter, conceal, or destroy an original or potential evidence. Security, privacy, and incident records should be coordinated with applicable incident procedures rather than deleted during an active review.

Legal holds and preservation

A legal hold may be required when the company reasonably anticipates litigation, a government inquiry, an investigation, an audit, a dispute, or another matter for which information may be relevant. Upon adoption, management should designate who may issue, modify, monitor, and release a hold, with legal direction for the scope and duration.

A hold notice should identify the matter, relevant custodians and systems, record types, preservation instructions, and a contact for questions. Recipients should acknowledge the notice, preserve relevant information in their possession or control, and report changes in systems, devices, vendors, or responsibilities that could affect preservation.

A legal hold overrides ordinary disposal, including automated deletion and category-based schedules. The proposed owner and system administrators should suspend affected disposal, preserve relevant information in a defensible manner, periodically confirm that the hold remains effective, and document release only after authorized legal direction. A hold release does not authorize disposal if another schedule or obligation still applies.

Responsibilities and official reference

Upon adoption, everyone covered by the Standard should create, classify, store, preserve, and dispose of records according to the approved schedule and promptly raise uncertainty. Management should fund and support the controls; category owners should maintain accurate inventories; system administrators should implement approved controls; and the proposed owner should monitor exceptions, training, and evidence of disposition.

The IRS explains recordkeeping considerations in its official guidance at https://www.irs.gov/businesses/small-businesses-self-employed/how-long-should-i-keep-records. That guidance is a reference for applicable tax recordkeeping questions; it does not establish one universal retention period for every company record and does not replace legal or professional advice.

Retention and legal-hold records should themselves be preserved by category. This draft does not promise that a schedule will satisfy every jurisdiction, contract, or proceeding; management and legal should approve the final schedule and hold process before adoption.