Skip to main content
Governance Authority
Category: Policy and Document Management

Retention Schedule

Also known as: Records Retention Schedule, Records Retention Policy
Simply put

A retention schedule is a policy document that lists the types of records an organization creates or receives and states how long each type should be kept. It also sets out what happens to a record at the end of that period, such as whether it is destroyed, transferred to an archive, or reviewed again. It is used to help an organization meet its recordkeeping obligations in a consistent way.

Formal definition

A retention schedule is a controlled document that inventories an organization's record series and assigns to each a defined retention period and eventual disposition, typically archival transfer, destruction, or further review, across the record's life cycle. It generally reflects the entity's legal, regulatory, and operational recordkeeping requirements, which vary by jurisdiction, sector, and entity type. The applicable retention periods and disposition rules depend on the specific obligations that govern a given record and on the organization's own governance decisions; this entry is educational and not legal, audit, or compliance advice.

Why it matters

A retention schedule gives an organization a consistent, defensible basis for deciding how long to keep records and what to do with them at the end of that period. Without one, retention decisions tend to be made ad hoc by individual employees or departments, which can leave the organization holding records longer than necessary, disposing of records it was obligated to keep, or being unable to explain why a given record no longer exists. A documented schedule that reflects the organization's legal, regulatory, and operational recordkeeping requirements helps demonstrate that disposition happened as a matter of routine policy rather than to conceal or avoid producing information.

The applicable retention periods and disposition rules depend on the specific obligations that govern a given record, and those obligations vary by jurisdiction, sector, and entity type. Because of this, a retention schedule is generally treated as a living document that must be maintained and updated as requirements and business needs change, rather than set once and left unchanged. Getting it wrong in either direction carries consequences: premature destruction can undermine legal and audit positions, while indefinite over-retention increases storage cost and expands the volume of information exposed in the event of a breach or a discovery request.

This entry is educational and not legal, audit, or compliance advice. Whether a particular record must be retained, and for how long, depends on the facts, the governing obligations, and the organization's own governance decisions, which should be confirmed with qualified advisors.

Who it's relevant to

Records and information management professionals
These practitioners typically own the development and upkeep of the retention schedule, including the inventory of record series and the assignment of retention periods and disposition rules. They are generally responsible for keeping the schedule current as recordkeeping requirements and business needs change.
General counsel and legal teams
Legal teams help interpret the legal and regulatory obligations that inform retention periods and disposition, which vary by jurisdiction, sector, and entity type. They also have an interest in ensuring records are neither destroyed prematurely nor over-retained in ways that create legal exposure.
Compliance officers
Compliance functions rely on the retention schedule to help the organization meet its recordkeeping obligations in a consistent way and to demonstrate that disposition follows documented policy rather than ad hoc practice.
Internal auditors and assurance functions
Auditors may assess whether the retention schedule exists, reflects applicable requirements, and is actually being followed across the record life cycle. Their focus is generally on whether the policy is designed appropriately and operating as intended, not on owning the schedule itself.
Business and operational units
The departments that create, receive, and use records apply the schedule day to day. Their understanding of the records and the periods for review, destruction, or transfer is important both to building an accurate schedule and to executing disposition correctly.

Inside Retention Schedule

Record Categories
A structured inventory of the types or classes of records an organization creates and holds, often organized by function, department, or business process, so that retention rules can be applied consistently across similar records.
Retention Periods
The length of time each record category is to be kept before disposition, typically driven by legal and regulatory requirements, operational need, and litigation considerations. Required minimum periods vary by jurisdiction, sector, and record type.
Legal and Regulatory Basis
References to the statutes, regulations, or other authorities that justify each retention period. Because obligations differ across jurisdictions and industries, the applicable basis should be identified for each category rather than assumed to be uniform.
Disposition Instructions
Guidance on what happens at the end of the retention period, such as secure destruction, archiving, or transfer, including any approval steps required before disposition occurs.
Ownership and Accountability
Assignment of responsibility for maintaining records and applying the schedule. Management typically owns operational execution, while boards or committees may exercise oversight of the broader records governance program depending on the entity's structure.
Legal Hold Interaction
Provisions addressing how routine disposition is suspended when records become subject to a legal hold due to actual or anticipated litigation, investigation, or regulatory inquiry, which typically overrides the standard retention period.

Common questions

Answers to the questions practitioners most commonly ask about Retention Schedule.

Is a retention schedule the same thing as a records retention policy?
No. They are related but distinct instruments. A records retention policy generally sets out the organization's principles, governance, roles, and overall approach to keeping and disposing of records. A retention schedule is typically the operational tool that lists specific record categories or classes and assigns a retention period and disposition action to each. The policy establishes the framework; the schedule applies it to particular record types. In practice both are usually needed, and the schedule should be traceable back to the policy.
Does having a retention schedule mean records can always be destroyed once the retention period ends?
Not automatically. A stated retention period is generally the minimum or planned holding period, but disposition can be suspended by a legal hold arising from litigation, investigation, regulatory inquiry, or audit. Where such a hold applies, the schedule's disposition action is overridden until the hold is lifted. Retention periods may also depend on jurisdiction, sector, and record type, and some obligations run from an event (such as contract termination) rather than the date of creation. Whether destruction is appropriate is a facts-specific judgment, not something the schedule alone determines.
Who is typically accountable for owning and maintaining a retention schedule?
Accountability arrangements vary by organization. In many entities, records or information management functions maintain the schedule operationally, while legal or compliance functions advise on retention requirements and legal holds. Business or process owners generally provide input on the records they generate and are responsible for applying the schedule day to day. Under a three-lines model, ownership and application usually sit with management (first line), with compliance advising (often second line) and internal audit providing assurance over how the schedule operates (third line). The board or a committee may oversee the framework rather than administer it.
How are retention periods usually determined for each record category?
Retention periods are generally derived from a combination of legal and regulatory requirements, operational or business needs, and, in some cases, historical or evidentiary value. Because requirements vary by jurisdiction, sector, and entity type, organizations typically map applicable obligations to each record category and, where multiple requirements apply, commonly adopt the longest mandated period unless there is a reason to do otherwise. Where no specific legal requirement exists, the period is often set by business judgment. Determining the correct period is a legal and professional judgment and this entry is educational rather than advice.
How can an organization keep a retention schedule current?
Retention schedules are generally reviewed on a periodic basis and when triggering events occur, such as changes in law or regulation, new systems or record types, reorganizations, or changes in business activities. Common practices include assigning clear ownership for maintenance, establishing a defined review cycle, and coordinating with legal and compliance to capture changing requirements. Version control and documented approvals help demonstrate that the schedule reflects current obligations. The appropriate review frequency depends on the organization's risk profile and regulatory environment.
How does a retention schedule relate to legal holds in practice?
A retention schedule and a legal hold process typically operate together but serve different purposes. The schedule governs routine retention and disposition in the ordinary course, while a legal hold suspends disposition for records that may be relevant to actual or anticipated litigation, investigation, or regulatory matters. In practice, organizations generally maintain a mechanism to identify held records, prevent their scheduled destruction, and resume normal disposition once the hold is released. The interaction is often a point of exposure, so clear coordination between records management and legal is commonly emphasized.

Common misconceptions

A retention schedule tells you the maximum time records may be kept, so keeping records longer is always safer.
Retention periods often reflect required minimums, but over-retention can create its own risks, including increased discovery burden, privacy exposure, and inconsistency with data minimization expectations under certain regimes. Whether longer retention is advisable generally depends on the record type, applicable law, and the organization's own judgment.
One standard retention schedule can be applied universally across all organizations.
Required retention periods vary by jurisdiction, sector, and entity type, and are driven by differing legal, regulatory, and operational requirements. A schedule generally must be tailored to the specific obligations and circumstances that apply to a given organization.
Once a retention schedule is documented, disposition can proceed automatically at the end of each period.
Routine disposition is typically suspended for records subject to a legal hold arising from actual or anticipated litigation, investigation, or regulatory matters. A hold generally overrides the scheduled disposition, so schedules must operate alongside a functioning legal hold process.

Best practices

Map record categories to the specific legal and regulatory requirements that apply to your jurisdiction, sector, and entity type rather than adopting a generic schedule, and treat the schedule as educational guidance to be validated with qualified legal and compliance advisors.
Assign clear ownership so that management is accountable for operational execution of retention and disposition, while the board or relevant committee exercises appropriate oversight of the records governance program.
Integrate the retention schedule with a documented legal hold process so that routine disposition is suspended whenever records become subject to litigation, investigation, or regulatory inquiry.
Review and update the schedule periodically to reflect changes in applicable law, regulation, business processes, and record types, and record the basis for each retention decision.
Balance minimum retention requirements against the risks of over-retention, such as discovery burden and privacy exposure, applying professional judgment to the organization's specific circumstances.
Document disposition steps, required approvals, and evidence of execution so the organization can demonstrate that records were handled consistently with the schedule.