Keeping Records Only as Long as You Need Them

Forever is the default

Nothing in a small business ever forces the deletion of anything.

Storage is cheap, inboxes are large, and there is no moment at which somebody is prompted to decide whether an enquiry from 2014 is still needed.

So the effective policy is to keep everything, and it was never a decision anybody made.

This is a general description rather than legal advice. Retention obligations differ by jurisdiction, sector, and record type, and an accountant or an industry body can give you the specific periods for yours.

Why holding everything is a cost

Three reasons, and only one is about compliance.

Anything you hold is something that can be lost, and the size of a breach is determined by how much you were holding rather than by how you were breached.

Anything you hold is something you may have to search and produce if somebody asks what you have about them, and nine years of email makes that a day's work rather than an hour's.

And old records are frequently wrong, so a business acting on a 2015 address or an outdated preference is using data that has quietly become inaccurate.

None of that is dramatic, and together they are why the sensible position is to keep what you need and not more.

What sets the floor

• Tax and accounting obligations, which are usually the longest.
• Warranty or guarantee periods you offer.
• Limitation periods for claims, which vary by place.
• Sector rules, in regulated trades and professions.
• Employment records, with their own requirements.
• Insurance conditions, which sometimes specify retention.

Establish the longest of those that applies to a given record type, and that is your floor. Everything above it is a choice you are making.

Set periods by record type, not overall

The practical structure, and it stops this becoming impossible.

A single retention period for the whole business does not work, because an invoice and a website enquiry have nothing in common.

Group them instead: financial records, customer job records, enquiries that never became customers, mailing list entries, job photographs, employment records, and supplier correspondence.

Seven or eight categories covers a small business, and each gets one period.

Write it on one page. A retention schedule for a nine-person firm should fit on a single sheet, and anything longer will not be followed.

The unconverted enquiry is the easy win

Worth singling out because it is the largest volume and the lowest value.

Enquiries that never became customers have no tax obligation attached, no warranty, and usually no continuing purpose after a modest period.

A year or two is defensible for most businesses, on the basis that somebody may come back, and beyond that the record is doing nothing.

Deleting those is straightforward, removes a large share of the personal information you hold, and touches nothing anybody needs.

For most small businesses this single category is the majority of the exercise.

A worked example

A firm set periods for six categories in about forty minutes with their accountant on the phone for ten of them.

Financial records took the longest statutory period. Job records were set to that plus the warranty they offered. Unconverted enquiries were set to two years. Mailing list entries until unsubscribed. Job photographs to five years. Employment records per the applicable requirements.

Applying it was the harder half, and they did it in stages.

The mailing platform already had the tools. The enquiry archive was deleted in one pass, removing several thousand records. Email was handled with a rule that archived anything older than the relevant period into a folder reviewed annually rather than deleted automatically.

The photographs took longest because they were spread across devices.

A year later the routine had held for everything except the photographs, which the owner described as the honest outcome rather than the intended one.

Applying it is the real work

Writing periods takes an hour. Deleting on schedule is where this succeeds or fails.

Where a system has automatic retention settings, use them, because anything requiring a person to remember will eventually stop.

Where deletion must be manual, put it in the calendar as a recurring task with a named owner, in a quiet month.

Do it in batches rather than continuously, since nobody will delete records weekly.

And accept that some categories will be handled well and others not, which is better than an all-or-nothing approach that collapses entirely.

Backups and the honest position

The complication everybody hits, and it has a sensible answer.

Deleting a record from a live system does not remove it from backups, which by design hold historical copies.

Expecting backups to be edited is neither practical nor good practice, and the generally accepted position is that backups age out on their own cycle.

What matters is that they are on a defined cycle rather than kept indefinitely, that deleted records are not restored back into live systems, and that the backups themselves are secured.

Say so in your policy rather than implying instant total erasure, which is a claim you cannot keep.

The counter-case

Deleting has its own risks and can be done too enthusiastically.

Records that turn out to be needed for a dispute, a warranty claim, a tax query, or an insurance matter are extremely inconvenient to have destroyed, and the cost of that usually exceeds the cost of having kept them.

There is also genuine commercial value in history: knowing what you did for a customer eight years ago, what a property looked like before work, or what was agreed with a supplier.

Where a record has continuing business value and no obligation to delete it, keeping it is a legitimate choice provided you can say why.

The target is deliberate retention rather than minimal retention, and the failure this addresses is having never decided at all.

The schedule

1. List six to eight record categories.
2. Ask your accountant for the statutory floors.
3. Add warranty and limitation periods where relevant.
4. Set one period per category, on one page.
5. Delete unconverted enquiries first.
6. Automate where the system allows, calendar the rest.
7. Say what happens with backups, honestly.

Step five is the largest single reduction available and touches nothing anybody needs.

Finding what you hold is covered in the personal information you did not realise you held.

Frequently asked questions

West Coast Media Solutions Inc. provides web design, web development, hosting, digital marketing, and business consulting to organisations across Canada, drawing on more than twenty-five years in the field.