Data retention policy template with a value review before deletion

When to use this data retention policy template

Use this template when a mid-sized company has no written retention rules, or has rules that no system actually enforces. The usual prompts are a system migration, a push to cut storage or former-employee mailbox costs, an audit or lender request, a privacy review, or a new owner asking what records exist.

A data retention policy says how long each class of records is kept, who is responsible for it, how deletion stops when litigation or an investigation is likely, and how records are destroyed when their time is up. This version adds a step most templates skip: a pre-disposal value review that asks whether old records are worth keeping before anyone deletes them, including whether the company could license them.

Retention policy, retention schedule and deletion policy: what is the difference?

The terms get used interchangeably, but they are four different documents. Mid-sized companies often combine them into one, which is what this template does.

The data retention policy template

Copy each block into your policy document and replace every placeholder in braces.

1. Purpose and scope

2. Roles

3. Retention schedule

4. Legal hold

5. Pre-disposal value review

6. Disposal

7. Exceptions and review

Appendix A: retention schedule template

Set each period with your counsel and tax adviser. Federal, state, contractual and industry requirements differ, so the template uses placeholders rather than numbers.

Privacy law can set the outer limit for personal information. The California Consumer Privacy Act requires a covered business to tell consumers at collection how long it intends to keep each category of personal information, and to keep it no longer than is reasonably necessary for the disclosed purpose; see the CCPA statute text, including Civil Code section 1798.100. Whether it applies depends on the company's size and activities. This is general information, not legal, tax or financial advice. Confirm periods and obligations with your own counsel and tax adviser before adopting the schedule.

Appendix B: the pre-disposal value review

Run this checklist for each record class or system before deletion. It usually takes one conversation with the system owner and, for anything flagged, one with counsel.

• Hold check: no legal hold, audit request or open dispute touches these records.
• Obligation check: no law, contract or customer agreement requires keeping them longer.
• Promise check: deletion, and any other future use, matches what the privacy policy, terms of service and customer contracts promised.
• Cost check: the yearly cost of keeping a complete export in low-cost archive storage is known.
• Value check: the records span several years, connect to other systems and show outcomes, such as tickets resolved, deals won or lost and approvals given or refused.
• Export check: someone can still produce a complete, readable export with attachments and metadata.
• Decision logged: the policy owner signs off on the outcome.

The promise check matters most if the company might ever license records. FTC staff wrote in January 2024 that promises not to use customer data for undisclosed purposes, such as training AI models, are enforceable, whether they sit in a privacy policy, terms of service or marketing materials. That is staff guidance rather than a rule, but it is a good reason to read what the company told customers before keeping anything for that purpose.

How to act on the review

For the last row, the company fit checker offers an initial, non-binding view of whether the company matches what AI labs and data buyers look for. If the owner wants to weigh it properly, the data licensing business case template frames the decision, and the CFO checklist for evaluating a data licensing agreement covers what to examine if an offer follows.

How to personalize the template

When to revisit the policy

• At fiscal year-end close, when the controller already confirms which records the year produced.
• Before any system migration, mailbox clean-up or chat-plan downgrade; the guides on former employee mailboxes in Microsoft 365 and what a Slack or Teams downgrade does to message history show where history tends to disappear.
• After an acquisition, when the acquired company's archives arrive with their own rules.
• Whenever the privacy notice or standard customer contracts change.

What never to put in a retention policy

• Periods the company does not follow in practice, such as a deletion rule no system enforces.
• Real confidential records, customer names or sample data used as examples.
• A commitment to license, sell or share records. That decision belongs to the owner and a signed agreement, not to a policy.
• Periods copied from another company's policy without advice.

Next step

Adopt the policy with the value review in place, then start with the oldest systems. If a client's records look valuable and the company has 50+ full-time employees at peak (contractors excluded), see how fractional CFOs make referrals, then register as a partner to make an introduction.