Retention, legal holds and records management in the US

Keeping data too briefly can break the law, lose evidence and harm the business. Keeping it too long can also break the law, multiply the damage from a breach and drive up storage and discovery costs. Retention is the discipline of keeping each kind of information for the right period and then disposing of it properly. The 2024 outline includes data retention in the data life cycle (sub-domain 2.4) and asset retention in sub-domain 2.5. This lesson covers retention schedules, the legal and regulatory minimums and maximums that shape them, legal holds, records management, and how to make disposal happen in practice.

Why retention matters for security

Every record kept beyond its useful life is a liability with no matching benefit. Breach reports regularly reveal attackers stealing years of old customer records that no one needed: former customers, unsuccessful applicants, expired accounts. Over-retention increases notification costs, fines and lawsuits after a breach, makes privacy access requests harder to answer, and increases the cost of electronic discovery in litigation, where every relevant record held must be searched and possibly produced. Under-retention has its own costs: tax penalties, inability to defend claims, regulatory sanctions and, if records are destroyed when litigation is expected, accusations of spoliation of evidence. A good retention program balances these risks deliberately.

The retention schedule

A retention schedule, sometimes called a records retention schedule or disposition schedule, lists categories of records, how long each must be kept, the event that starts the clock, the legal or business reason, the owner, and what happens at the end: destruction, transfer to an archive or review. Records are grouped into categories such as employee files, customer contracts, invoices, tax records, system logs and marketing lists, so that the schedule stays manageable. The trigger event matters as much as the period: seven years from the end of the fiscal year, two years after an employee leaves, one year after the last customer transaction.

Setting periods requires input from legal counsel, records managers, the business owners of each category, privacy and security. The schedule should be approved by senior management, published, reviewed at least every few years and whenever laws change, and applied to all formats and locations, including email, chat, cloud services and backups.

Legal minimums

In the United States, the Internal Revenue Service generally advises keeping tax records for three years after filing, six years if income was under-reported by more than 25 percent, seven years for claims involving bad debts or worthless securities, and at least four years for employment tax records. HIPAA requires covered entities and business associates to keep required documentation, such as policies, risk analyses and authorizations, for six years from creation or last effective date; medical record retention itself is set by state law. SEC Rule 17a-4 requires broker-dealers to keep many records for three or six years, the first two years in an easily accessible place, on systems that either prevent alteration (write once, read many) or keep a complete audit trail under the 2022 amendments. Sarbanes-Oxley requires auditors to keep audit workpapers for seven years. Employment laws add further minimums, such as payroll records under the Fair Labor Standards Act.

Legal minimums vary by jurisdiction, industry and record type, and a multinational organization usually adopts the longest applicable minimum for each category unless privacy rules require something shorter. The schedule should cite the source of each period so that it can be checked and updated.

Legal maximums and privacy

US privacy laws increasingly set maximums as well. The CCPA as amended by the CPRA requires businesses to disclose how long they keep each category of personal information and prohibits keeping it longer than reasonably necessary for the disclosed purpose. The FTC has brought enforcement actions against companies that kept data indefinitely without need, and its Safeguards Rule for financial institutions requires disposal of customer information no later than two years after its last use unless a business or legal reason requires otherwise. The FTC Disposal Rule requires reasonable measures to dispose of consumer report information, and many states have data disposal laws requiring that records containing personal information be shredded, erased or otherwise made unreadable.

Internationally, the GDPR's storage limitation principle requires that personal data be kept in identifiable form no longer than necessary for the purposes for which it is processed. The common thread is clear: retention must be justified by a purpose, and when the purpose ends, the data should go, unless a law requires it to stay.

Legal holds

A legal hold, also called a litigation hold or preservation order, suspends normal disposal for records relevant to actual or reasonably anticipated litigation, investigations or audits. Once the organization reasonably expects a dispute, it has a duty to preserve relevant information, and destroying it, even under the normal retention schedule, can lead to court sanctions and adverse inferences. Legal holds are issued by legal counsel, identify the custodians and data sources involved, override retention rules for the affected records, and remain in place until counsel formally releases them.

Security and IT teams play a key role. They must be able to suspend automatic deletion for particular mailboxes, accounts, devices and cloud repositories; preserve departing employees' data and devices when holds apply; and track which systems are under hold. Many email and collaboration platforms have built-in hold features that preserve content without users knowing, which avoids tipping off a custodian who might delete evidence. Holds should be reviewed regularly, because forgotten holds become over-retention.

Records management

Records management is the discipline of managing records, meaning information created or received as evidence of business activities, throughout their life. ISO 15489-1:2016 sets out international principles. Records management decides what counts as a record, classifies records into the categories of the retention schedule, makes sure records are authentic, reliable, complete and usable, and carries out disposition. Not everything is a record: drafts, convenience copies and transitory messages often are not, and policies should say so, so that they can be deleted promptly.

US federal agencies are governed by the Federal Records Act, under which records may be destroyed only according to schedules approved by the National Archives and Records Administration (NARA), and permanent records are transferred to NARA. The Presidential Records Act covers presidential records. States have their own public records and archives laws, and freedom of information laws make unlawful destruction of requested records an offense in many jurisdictions.

Electronic records raise specific challenges. Email and chat contain records mixed with trivia; cloud services keep versions and deleted items; and records may need to stay readable and authentic for decades. Records management systems can enforce retention automatically: labels applied to records trigger retention and disposition when the trigger event occurs, and disposition can require review by an owner before destruction.

Making disposal happen

Most organizations are better at keeping data than at getting rid of it. Disposal fails because no one owns it, because people fear deleting something they might need, and because data is spread across too many places. Practical steps include automating disposition in systems that support it, setting retention policies on email and collaboration platforms, scheduling periodic clean-ups of file shares and legacy systems with owner sign-off, and including disposal in system decommissioning plans. Backups need special thought: rather than editing backups to remove individual records, organizations usually let them expire on a defined cycle, keep backup retention as short as recovery needs allow, and prevent restored backups from bringing deleted records back into production.

Thinking like a manager

Exam questions on retention often ask what overrides what. A legal hold overrides the normal schedule; the schedule overrides individual preferences; legal minimums set the floor and privacy principles set the ceiling. The right answer to an employee who wants to keep everything forever is the schedule, and the right answer to a request to delete records relevant to anticipated litigation is to refer it to legal counsel and preserve them. Retention decisions belong to owners, guided by legal counsel and records managers, and carried out by custodians.

Retention in email and collaboration platforms

Email, chat and collaboration platforms deserve their own retention rules, because they hold a mixture of records, transitory messages and personal information, and because users rarely sort them. Common approaches set a default retention period for mailboxes and chats, such as two or three years, apply longer labels to messages that are records, and delete everything else automatically when its period ends. Chat messages are increasingly treated like email for discovery purposes, so courts and regulators expect them to be covered by the schedule and by legal holds. Personal messaging apps used for business, such as text messages on personal phones, are a growing problem: regulators in the financial sector have fined firms heavily for failing to retain business communications sent through unapproved apps. The simplest control is to provide approved tools with built-in retention and to prohibit business use of unapproved ones.