Data Retention: How Long Should You Keep a Closed Case?

There are two default retention policies in most small practices. The first is "keep everything, forever, just in case". The second is "delete whatever is in the way when we run out of space". Both are indefensible when a regulator or a court asks, and the second one is dangerous.

The principle

Data protection law in most jurisdictions says the same thing in different words: keep personal data no longer than necessary for the purpose you collected it. "Necessary" is yours to justify, but it must be a reason — a limitation period, a statutory record-keeping duty, a professional obligation — not a habit.

Common anchors

• Contractual disputes — the limitation period for a claim, counted from the end of the relationship, often six years.
• Tenancies — the deposit dispute window plus the limitation period; safety certificates have their own minimums.
• Employment matters — from the end of employment; tribunal windows are short, but some payroll and pension records must be kept far longer.
• Investigations — until the matter and any proceedings arising from it are exhausted, plus any regulatory minimum.
• Research — the funder's and the ethics committee's requirements, frequently ten years for underlying data.

Write the anchor into the template as a rule: closed date plus N years equals review date. A retention date nobody can see is a retention date nobody honours.

Review, then dispose — deliberately

When the date arrives the question is not "delete?" but "do we still have a reason?". Sometimes the answer is yes — a related matter is live, a claim has been threatened. Record the decision either way. In Herarx that decision can be asked of a named person by a rule, with the options laid out, and the answer is kept on the case.

Disposal that can be evidenced

Deleted cases go to Trash for thirty days, then are purged. Permanent deletion needs an explicit confirmation and, if deletion protection is on, a code and a waiting period in organisations. The deletion oversight log records the request, who confirmed it and when. That log is what you show when someone asks "can you prove it was destroyed?".

What to keep after disposal

A skeleton record: the case reference, the parties' names, the dates, and the fact of disposal. Not the contents. It lets you say truthfully "we had a file, it was destroyed on this date under this policy" — which is a much better answer than either "we have everything" or "we have nothing and don't know why".