How Long to Keep What

Two obligations pulling opposite ways

The reason this is confusing.

Keep it. Tax, employment, and corporate records have minimum retention periods, and destroying them early creates a problem if anything is ever examined.

Do not keep it. Privacy legislation requires that personal information not be retained longer than necessary for the purpose it was collected for, and holding it indefinitely is itself a failure.

Which means a business needs to know which category each thing falls into, and most treat everything the same way by keeping all of it forever.

The records with minimum periods

Broadly, and the specifics are worth confirming rather than assuming.

Tax records generally must be kept for a period measured in years from the end of the relevant tax year, with longer or indefinite requirements for certain corporate records such as those relating to share capital and directors.

Employment records, payroll, and hours are governed by provincial employment standards legislation, with periods that differ by province.

Records relating to a matter under objection or appeal generally must be kept until it is resolved, regardless of the ordinary period.

Contracts, warranties, and anything with a limitation period attached are worth keeping until the period for a claim has passed, which is longer than most businesses assume.

The applicable revenue authority and provincial employment standards branch are the references, since periods change and differ, and a business should confirm what applies to it rather than adopting a figure from an article.

The information that should be going

Where small businesses accumulate exposure without noticing.

• Enquiry form submissions, which sit in a database indefinitely by default.
• Old quotes for work that never happened.
• Mailing list entries from people who never engaged.
• Job photographs showing customer property.
• Applications from candidates not hired.
• Payment details stored in any form, which should not be there at all.
• Former employees' mailboxes and files.

The first is the most common and the least considered. A form storing submissions since the site launched holds years of names, addresses, and descriptions of people's properties, for no purpose.

Setting periods

The practical exercise, which takes an hour.

1. List the categories of record and information you hold.
2. For each, decide why you hold it, which is the question that resolves most of them.
3. Assign a period, using the legal minimum where one applies and the purpose where it does not.
4. Write it down, in a page.
5. Automate what can be automated, such as form submission deletion.
6. Diarise a review for what cannot.

The second step does most of the work. A business that cannot state why it holds something has answered the retention question.

Deleting properly

Where the exercise is undone.

Deleting from one system leaves copies in backups, in email, in exports, in cloud storage, and on devices.

The workable position: delete from the live system, let backups age out on their own cycle, and know how long that cycle is, since a backup retained for years contains everything you deleted.

Paper needs handling too. Job sheets, printed quotes, and application forms with personal details on them should be destroyed rather than binned.

And devices, since a phone or laptop being replaced carries whatever was on it, which is why encryption makes disposal straightforward.

What to keep permanently

Deliberately rather than by default.

Corporate records, insurance policies including expired ones since claims can arise later, records of significant work with any long-term liability attached, and anything relating to property.

For a trade, records of what was installed where and to what specification are worth keeping well beyond any minimum, since a question about work done years ago is answerable only from your own records.

The benefit beyond compliance

Worth stating because it is the reason to actually do it.

Information you do not hold cannot be lost, exposed, or requested. Every category reduced is a reduction in what an incident would involve.

It also makes the systems usable, since a customer database with fifteen years of dead entries is harder to work with than one that reflects the business.

The starting point is knowing what exists, which is the harder half and which most businesses have never mapped, and it applies to the accounts holding it as much as to the records themselves, as covered in accounts nobody uses any more.

Frequently asked questions

West Coast Media Solutions Inc. provides web design, web development, hosting, digital marketing, and business consulting to organisations across Canada, drawing on more than twenty-five years in the field.