Most small businesses have no retention policy, which means they have one by accident: keep everything forever, in whatever folder it landed in. That's not the worst possible policy, but it has two real costs. Old records you don't need are still records you're responsible for protecting. And a drive full of everything is a drive where finding the thing that matters takes longer every year.
A retention policy is just a decision, made once, about categories of documents instead of individual files.
Three tiers is enough
Forget elaborate schedules. Sort everything you keep into three buckets.
Permanent — keep for the life of the business and beyond. These are documents that establish what the business is, what it owns, and what it agreed to.
Long-term — keep for a defined number of years past a triggering event, usually a tax filing or contract end.
Short-term — keep while operationally useful, then delete on a schedule.
The work is deciding once which bucket each type of document falls into. After that, filing is automatic.
Permanent: never delete these
- Formation documents — articles of incorporation, partnership agreements, operating agreements, and every amendment
- Ownership records — share certificates, cap table history, buy-sell agreements
- Tax identification and registration documents
- Filed tax returns themselves (the returns, not necessarily every supporting receipt)
- Property deeds, vehicle titles, and any document proving ownership of a significant asset
- Intellectual property — trademark and patent registrations, copyright filings, assignment agreements
- Licenses and permits, including expired ones
- Insurance policies, especially any liability policy written on an occurrence basis, where a claim can arise decades after the policy period
- Legal judgments, settlements, and litigation records
- Records of ownership transfers, mergers, or sales
The permanent pile for most small businesses is surprisingly small — often under a hundred documents. That's the pile that deserves the most protection: multiple copies, one off-site, and ideally one that isn't dependent on any single cloud account continuing to exist.
Long-term: keep for a defined period past the trigger
This is the largest category, and the numbers depend entirely on your jurisdiction, so treat the following as the shape of the answer rather than the answer itself. Confirm the actual periods with your accountant or your national tax authority's published guidance.
Tax supporting records — receipts, invoices, statements, expense summaries, mileage logs. The clock starts at the filing date, not the transaction date. Many jurisdictions specify several years, with longer periods for substantial under-reporting and no limit at all in cases of fraud or unfiled returns.
Employment records — payroll, tax withholding, hiring and termination documents, benefits records. Employment record requirements are often longer than tax requirements, and they're frequently governed by separate agencies with separate rules.
Contracts and agreements — keep for the term plus the applicable limitation period for contract claims in your jurisdiction, which can run several years past termination. For contracts involving a warranty, guarantee, or ongoing indemnity, the clock starts when that obligation ends, not when the work finished.
Asset records — purchase invoices for depreciable assets need to survive the entire depreciation period plus the tax retention period after disposal. In practice, this means asset paperwork is often kept for a decade or more.
Bank and credit statements — align with your tax retention period, but note that you cannot rely on the bank to hold them for you. Download and store your own copies.
The safest framing: for anything in this tier, retention isn't measured from when the document was created. It's measured from when the last obligation connected to it ended.
Short-term: delete on purpose
- Routine correspondence with no decision or commitment in it
- Duplicate copies and superseded drafts
- Vendor quotes you didn't accept
- General inquiries that never became clients
- Meeting notes for meetings that produced nothing actionable
- Old marketing files for campaigns long finished
- Personal data collected for a one-off purpose that's now complete
That last item isn't optional in many places. Privacy regulations in numerous jurisdictions require that personal data not be kept longer than necessary for the purpose it was collected. A mailing list from an event five years ago, a spreadsheet of applicant details from a role you filled, a folder of customer addresses from a shop you closed — these are liabilities, not assets. Deleting them is compliance work, not housekeeping.
Write it down, in one page
A retention policy nobody can find is not a policy. Make a single document, 01 Admin/Retention Policy.md, structured as a table:
Document type | Tier | Keep until | Where it lives
Formation docs | Permanent | Forever | 01 Admin/Formation
Client contracts | Long-term | End of term + [X] years | 03 Clients/[name]/01 Contracts
Receipts | Long-term | Filing date + [X] years | 02 Finance/Receipts/[year]
Applicant CVs | Short-term | 12 months after role filled | 01 Admin/HR/Recruiting
Campaign assets | Short-term | 2 years | 05 Marketing/CampaignsFill the bracketed numbers with the periods that apply to you, confirmed with your accountant once. Date the policy and note when you last reviewed it.
The value of writing it down isn't bureaucratic. It's that deletion becomes defensible. Routine deletion under a documented policy is normal business practice. Ad hoc deletion of specific documents, especially once a dispute is on the horizon, is a different thing entirely — and that's why the next section matters.
The exception that overrides everything: legal hold
If you become aware of actual or reasonably anticipated litigation, an audit, or an investigation, deletion stops immediately for anything potentially relevant — regardless of what your schedule says. This is called a legal hold, and destroying records after the duty attaches can be far more damaging than whatever the records themselves contained.
Practically, for a small business: the moment you receive a demand letter, a claim, an audit notice, or you decide to sue someone, freeze the relevant folders and turn off any automatic deletion touching them. Write a dated note recording that you did. Then talk to a lawyer.
Automating the schedule
Retention only works if something triggers the review. Two mechanisms:
Date-stamped archive folders. Everything short-term gets archived by year. Once a year, you delete the year that's aged out. One folder, one decision, thirty seconds.
06 Archive/
Marketing/2022/ ← delete this year
Marketing/2023/
Marketing/2024/A yearly calendar entry. One recurring appointment, "Retention review," scheduled a month after your tax filing so the year's records have settled. Open the policy, work down the table, delete the aged-out folders, note the date on the policy.
Fifteen minutes a year. That's the whole system.
The thing people get backwards
Retention policies are usually explained as being about deletion. They're actually about protection.
The reason to define what's permanent is so the permanent things get real backup, real redundancy, and real attention. When everything is kept forever with equal weight, the formation documents are protected exactly as well as a 2019 vendor quote — which is to say, both are sitting on one drive and neither has been checked in years.
Sort by tier once, and the small permanent pile can get the treatment it deserves.
Retention periods vary by country, industry, and entity type, and some industries carry specific regulatory requirements. Confirm your actual periods with a qualified accountant or attorney; this is a framework, not legal advice.
Next in this series: How to Organize a Shared Team Drive Without Chaos