GuideHow to create a document retention schedule
A document retention schedule says what records you keep, for how long, who is responsible and what happens at the end. This guide explains how to build one step by step, and how to make sure it is actually followed.
Why you need a retention schedule
Without written rules, records are kept either forever or until someone has a clear-out. Both cause problems. Keeping everything means more to search, more to secure and more personal data held without a reason. Deleting at random risks losing a record you are required to keep, or one you need to defend a claim.
A retention schedule replaces those habits with a decision made once, for each type of record, by people who understand it. It also gives you an answer when a customer, employee, regulator or auditor asks why you still hold something, or why you no longer do.
Retention periods come from law, regulation, contracts and your own business needs, and they differ by country, sector and record type. Check the period that applies to you with your legal adviser, regulator guidance or professional body. This guide explains the method, not the periods.
Step 1: List your record types
Work through each department and list the kinds of records it creates or receives. Group them by what they are, not where they are stored. A supplier invoice is the same record type whether it sits in a filing cabinet, a shared drive or an accounting system.
Typical groups include:
- Finance: invoices, receipts, bank statements, payroll records
- HR: recruitment files, employee files, leaver records
- Customers: contracts, correspondence, complaints
- Suppliers: contracts, certificates, due diligence
- Governance: board minutes, policies, statutory registers
- Operations: project files, health and safety records
For each type, note where it is held, in what format, and whether it contains personal data. Keep the list at a level people recognise; too fine a split makes the schedule impossible to apply.
Step 2: Name an owner for each record type
Every record type needs an owner: a role, not a person, that understands why the records exist and can decide what happens to them. The finance manager owns supplier invoices; the HR manager owns employee files. The owner:
- Confirms the retention period and trigger with whoever advises on the rules
- Approves disposal when records reach the end of their period
- Decides on exceptions, such as keeping certain records longer for a reason
- Reviews the entry when the law or the business changes
A records manager, data protection lead or compliance officer usually coordinates the schedule as a whole, but should not own every line.
Step 3: Set retention periods and triggers
For each record type, record two things: how long to keep it and the event that starts the clock. The trigger matters as much as the period. Common triggers are:
- Creation date: the date the record was made or received.
- End of financial year: common for accounting records.
- End of a relationship: when an employee leaves, a customer closes an account or a contract ends.
- Completion of a matter: when a case, project or claim is closed.
- Superseded: when a newer version of a policy or certificate replaces it.
To set the period, list the sources that might apply: legislation, regulator rules, contract terms, insurance requirements and limitation periods for claims. Check the period that applies to you for each, then take the longest one that is relevant. Where personal data is involved, data protection law also expects you not to keep it longer than you need, so the period should be justified rather than padded.
Record the reason for each period in the schedule. When someone later asks why, the answer is written down.
What a retention schedule looks like
A schedule is usually a table. The layout below shows the columns most organisations need. Fill in the periods from your own advice.
| Record type | Owner | Trigger | Retention period | Reason | Action at end |
|---|---|---|---|---|---|
| Supplier invoices | Finance manager | End of financial year | Check the period that applies to you | Tax and accounting rules | Review, then destroy |
| Employee files | HR manager | Employee leaves | Check the period that applies to you | Employment law, possible claims | Review, then destroy |
| Customer contracts | Commercial lead | Contract ends | Check the period that applies to you | Contract terms, limitation periods | Review, then destroy or archive |
| Board minutes | Company secretary | Date of meeting | Check the period that applies to you | Company law | Review, then archive |
| Unsuccessful job applications | HR manager | Recruitment closes | Check the period that applies to you | Data protection, possible claims | Destroy |
Step 4: Plan review and disposal
A schedule only works if someone acts on it. Build disposal into a regular routine rather than an occasional project.
Find what is due
On a set cycle, list the records whose period has ended, using the trigger date and record type.
Check for holds
Remove anything under a legal hold or open request before going further.
Ask the owner
The record owner confirms disposal, or extends retention with a recorded reason.
Dispose securely
Delete electronic copies, including duplicates in other systems, and shred or securely destroy paper.
Record it
Write down what was disposed of, when, by whom and on whose approval.
Remember copies. A record deleted from the main system but still sitting in an e-mail attachment or personal drive has not really been disposed of.
Step 5: Handle legal holds
A legal hold suspends normal disposal for records that may be relevant to a dispute, investigation, audit or regulatory enquiry. Once you know or reasonably expect such a matter, the relevant records must be kept even if their retention period has ended.
- Name who can place and lift a hold, usually legal or compliance
- Record the matter, the record types or people covered and the date
- Tell the record owners, and make sure the hold stops disposal in every system
- Review holds regularly and lift them formally when the matter closes
Requests from individuals for their own data work in a similar way: records within scope should not be disposed of while a request is open. Our page on subject access request and FOI management covers that process.
Step 6: Keep evidence of disposal
Being able to show that you disposed of records according to your schedule is almost as important as doing it. A disposal log should record:
- The record type and a description or reference of what was disposed of
- The schedule entry that applied
- Who approved it and when
- The method used, and any certificate from a destruction provider for paper or equipment
Keep the log itself, but take care that it does not repeat the personal data you just removed. A reference and a count are usually enough.
Keep the schedule alive
Review the schedule on a regular cycle, and whenever a new system, record type or rule appears. Publish it where staff can find it, and include it in induction for people who create records.
How DocView can help you apply your retention schedule
A schedule is easiest to follow when records are already organised by type. In DocView Web each document type has its own fields and access, so the record types in your schedule can become document types, with fields for the dates that start the retention clock. Access is controlled by users and groups, and each document keeps a history of what happened to it and who did it.
The DocView Web workflow designer can assign steps to a role with Approve, Reject or your own actions, so we can configure a review routine in which record owners confirm or extend disposal. We configure the document types and fields from your schedule, and we build the retention rules, hold flags and disposal log your process needs on top of DocView. Paper records can be scanned and indexed with DocView Capture, so they follow the same rules as everything else.
These controls are designed to help you meet your obligations; the periods themselves remain a decision for you and your advisers.
Document retention schedule: questions
What is a document retention schedule?
It is a table that lists each type of record an organisation holds, who owns it, how long it is kept, what event starts that period, why, and what happens at the end.
How long should we keep our records?
That depends on the record type, your sector and the country you operate in. Check the period that applies to you with your legal adviser, regulator guidance or professional body, and write the reason in the schedule.
What is a legal hold?
It is an instruction to stop disposing of records that may be relevant to a dispute, investigation or enquiry, even if their retention period has ended. It stays in place until it is formally lifted.
Does the schedule cover paper and electronic records?
Yes. Retention depends on what the record is, not its format, so one schedule should cover paper files, scanned images, e-mail and documents in every system.
Is retention management an off-the-shelf DocView feature?
DocView Web provides document types, permissions, document history and a workflow designer. Dev Soft UK configures these for your schedule and builds the retention rules, holds and disposal log your process needs.
Talk to us about your records
Tell us what you hold and the rules you need to follow. We will show you how DocView could help you keep, review and dispose of records.