Regulators, insurers, clients and auditors increasingly ask small firms for their data retention policy. The ones that exist are often twelve pages copied from a template and enforced by nobody. The version below fits on one page and is enforceable because it maps directly onto how records are actually stored.
The policy in one table
A retention policy is a table with four columns: record type, trigger, retention period, action. Everything else is preamble.
| Record type | Trigger | Period | Action |
|---|---|---|---|
| Client matter files | Matter closed | Limitation period + 1 year | Review, then delete; keep skeleton |
| Contracts and signed agreements | Contract ended | Limitation period | Review, then delete |
| Financial and tax records | End of financial year | Statutory minimum (often 6–10 years) | Delete after period |
| Employee files | Employment ended | Per record type (see HR schedule) | Review, then delete; keep skeleton |
| Unsuccessful applicants | Vacancy closed | Months, not years | Delete |
| Marketing contacts | Last interaction | Until consent withdrawn or 2 years inactive | Delete |
| Sent/received | Filed to a matter: follows the matter. Otherwise: fixed period | Delete unfiled mail after period | |
| Backups | Backup taken | Rolling window | Overwritten automatically |
Fill in the periods from your own jurisdiction's minimums and your professional body's guidance. Where no law sets a period, the limitation period for a claim is the usual anchor.
The preamble (keep it short)
- Purpose: we keep records only as long as we have a reason to.
- Scope: all records, in all systems, including email and personal devices used for work.
- Owner: one named person is responsible for the schedule and the annual review.
- Exceptions: a legal hold pauses deletion for any record connected to a live or threatened claim; the owner records the hold and its release.
- Disposal: deletion is logged (what, when, under which rule, by whom); physical records are destroyed confidentially and the destruction certified.
Making the system enforce it
A policy that depends on someone remembering will fail. Attach the trigger and the period to the record itself: closing a matter sets its review date; the review date creates a task or asks a named person to decide; the decision and the deletion are logged automatically. In Herarx that is a template rule plus the deletion oversight log, described in how long to keep a closed case and deletion protection. Any system can do a version of it; the point is that the date lives on the record, not in a spreadsheet nobody opens.
The annual review
Once a year, the owner checks that the periods still match the law, that the holds list is current, that the deletion log shows deletions actually happened, and that new record types (a new service line, a new tool) have been added to the table. That meeting takes an hour and is the difference between a policy and a document.
