Records retention policy template

1. Purpose

This policy sets how [Organization name] keeps records for as long as the law and the business need them, protects them while they are kept, and disposes of them securely and on schedule when they are no longer needed.

2. Scope

• Applies to all employees, contractors and volunteers, and to all [departments, locations and entities].
• Covers records in every format: paper, scanned images, electronic files, email, databases, and records held for us by vendors and cloud services.
• A record is any information created or received in the course of business that documents a decision, a transaction, an obligation or an activity.
• A non-record (drafts, duplicates, reference copies, routine notices) is kept only as long as it is useful and is not covered by the schedule.

3. Definitions

4. Roles and responsibilities

5. Retention schedule

• Retention periods are set in the retention schedule in Appendix A, not in this policy. The schedule lists each record type, its owner, its trigger event, its retention period, the rule or business reason behind it, and its disposition.
• Where more than one rule applies to a record type, the longest period wins.
• The record owner keeps the official copy for the full period. Other copies are non-records.
• Changes to the schedule are approved by [the records manager] and [legal counsel], dated and kept.

Build Appendix A from the common US periods at ademero.com/resources/retention-schedules or the retention policy generator, then have counsel confirm every period for your state and industry.

6. Storage and format

• Records are stored in [approved systems and locations] only, with access limited to people who need them.
• Scanned records are [the official copy once checked for quality / kept alongside the paper original]. Paper originals of scanned records are destroyed after [a set period] unless the schedule or a legal hold requires the original.
• Electronic records stay readable for their full retention period. Long-term records are kept in [PDF/A or another archival format].
• Records containing personal, health or financial information are protected as set out in [the information security policy].

7. Legal holds

1. When litigation, an audit or an investigation is reasonably expected, [legal counsel] issues a written legal hold notice.
2. The notice names the matter, the record types, the date range and the people who hold relevant records.
3. Recipients confirm in writing that they received and understood the notice.
4. All scheduled destruction of records covered by the hold stops at once, in every format and location, including email and backups where needed.
5. Only [legal counsel] releases a hold, in writing. Records then return to their normal schedule.
6. [The records manager] keeps a log of every hold: matter, date issued, scope, recipients and date released.

8. Destruction and disposition

• Records are reviewed for disposition [every quarter] once their retention period ends.
• Before destruction, the record owner confirms that no legal hold applies and [the records manager] approves.
• Paper is destroyed by [cross-cut shredding or a bonded shredding vendor that provides a certificate of destruction].
• Electronic records are deleted from the system of record. Copies in backups expire on the backup schedule.
• Every destruction is logged: record type, date range, quantity or location, method, date, and who approved it. The log itself is kept [permanently].

9. Audits and review

• [The records manager] audits [two departments] each year: are records where the schedule says, are expired records disposed of, are holds respected?
• The policy and schedule are reviewed [every year], and whenever laws, systems or the business change.
• Findings and corrective actions are reported to [the executive sponsor].

10. Training and compliance

• New staff are trained on this policy within [30 days] of starting, and all staff [every year].
• Destroying, hiding or changing records outside this policy, or ignoring a legal hold, may lead to disciplinary action.
• Questions go to [records manager name, email].

11. Appendix A: Retention schedule