Data Retention and Deletion: The Policy Decision Growing Companies Make Too Late

A 70-person company gets hit by a phishing attack on a shared mailbox. The investigation finds the mailbox holds nine years of client emails, including scanned tax forms, signed contracts and photos of driver's licenses. Nobody decided to keep all of it. Nobody decided to delete any of it either.

That is the normal state of data at a growing company. Files pile up in shared drives, inboxes, old laptops and forgotten SaaS accounts because keeping things is free and deleting them takes a decision. A retention policy is that decision, written down once, so it stops being made by default.

Why Keeping Everything Is Not the Safe Choice

Old data feels harmless because nobody uses it. In a security incident, it counts the same as current data. If an attacker reaches a mailbox or file share, everything in it is exposed, and everything in it may have to be reported.

Cost follows volume. IBM's 2025 Cost of a Data Breach report put the global average breach at $4.44 million and the average in the United States at $10.22 million. Those are averages across all company sizes, and a 70-person firm will see a different number. But the direction is clear: the more records an incident touches, the more people you notify, the more the lawyers review and the longer cleanup takes.

Insurers and clients also ask. Cyber insurance applications and client security questionnaires increasingly include questions on how long data is kept and how it is destroyed. "We keep everything" is a harder answer to defend than "we keep client files for seven years, then delete them."

Keeping Too Little Is a Problem Too

The opposite mistake is just as real. Deleting records early can break legal and tax obligations, and it can look worse than keeping them.

The IRS generally says to keep records that support a tax return until the period of limitations runs out, which for most businesses is three years from filing. Employment tax records should be kept at least four years. Some situations run longer, such as claims for bad debt or worthless securities, and certain pandemic-era credits. The IRS recordkeeping guidance lays out each period.

Beyond tax, contracts, employee files, health records, grant documents and insurance policies each have their own required periods, set by federal law, state law or the agreement itself. The correct retention period for a record is the longest period that applies to it. Your attorney or accountant should confirm those periods. A security team should not guess at them.

What a Retention Policy Actually Contains

A usable policy is short. Four parts cover most of it.

1. A schedule by record type. A table or list of categories (client files, financial records, employee records, email, backups, system logs) with a retention period and the reason for it.
2. A start date for each period. "Seven years" means little without saying seven years from when: the end of the engagement, the end of employment, the date of the transaction.
3. A deletion method. Who deletes, how often, and how the deletion is confirmed. Scheduled and automated is better than a cleanup day nobody has time for.
4. A legal hold rule. A way to pause deletion for specific records when a lawsuit, investigation or audit is possible.

Here is a simple example of what a schedule looks like. The periods are placeholders, and the right ones depend on your industry and your attorney's advice.

Record type	Example period	Starts when
Signed client contracts	7 years	Contract ends
Payroll and employment tax	4 years minimum	Tax filed or paid
Employee personnel files	Set by counsel	Employment ends
Email	Set by counsel	Message date
Security and access logs	1 year	Log date

Legal Holds Override the Schedule

If a lawsuit is filed, or reasonably expected, the normal schedule stops applying to the records involved. Deleting them after that point can be treated as destroying evidence, even if the deletion was automatic and routine.

This is where automation needs a manual brake. If email auto-deletes after three years, someone needs to know how to switch that off for a specific mailbox or case, and who has the authority to do it. Write the name of that person into the policy. A legal hold written down after the lawsuit arrives is much less useful than one that already exists.

Regulators Already Expect Deletion in Some Industries

Some companies do not get to choose. The FTC Safeguards Rule, which applies to a wide set of financial institutions beyond banks (including tax preparers, mortgage brokers, auto dealers and some financial advisers), requires securely disposing of customer information no later than two years after it was last used to serve the customer. Exceptions apply where there is a legitimate business need or a legal requirement to keep it. The rule also requires periodic review of the retention policy.

The small business exemption in that rule covers companies holding information on fewer than 5,000 consumers. It relaxes the written risk assessment, the written incident response plan and the board reporting requirement. The disposal requirement is not part of what it relaxes. If your firm touches customer financial data, check with counsel whether the rule covers you.

HIPAA, state privacy laws and many client contracts add their own obligations. Healthcare practices, schools, non-profits and defense contractors each have a different mix. A policy built for one industry rarely fits another.

Deleting Data Correctly Is Its Own Step

Pressing delete does not destroy data. Files go to a recycle bin, backups keep copies, and retired laptops carry whole drives. NIST published SP 800-88 Revision 2, its guidelines for media sanitization, in September 2025. It describes three levels of sanitization (clear, purge and destroy) and asks organizations to run a sanitization program instead of handling disposal case by case. The NIST publication page has the full document.

For a growing company, the practical points are these:

• Cloud and SaaS data. Confirm that deleted items actually leave the platform, and learn how long the vendor keeps them in its own backups.
• Backups. A backup that holds data you deleted last year means the data still exists. Set backup retention to match the policy, and keep it long enough to recover from ransomware.
• Devices. Wipe or destroy laptops, phones and copiers with storage before they leave the company, and keep a record of it.
• Departing vendors. When you end a contract, ask for written confirmation that your data is deleted.

A Short Checklist to Start

Most companies can write a first version in a few weeks. A good order:

1. List where company data lives: file shares, email, SaaS tools, laptops, backups.
2. Sort it into five to ten record types.
3. Ask your attorney and accountant for the required period for each type.
4. Set deletion rules in the tools that support them (email, document storage, backup).
5. Name the person who can place a legal hold.
6. Review the policy once a year, and again after any acquisition or new line of business.

How Elevaire Fits In

Elevaire is a managed security services provider and virtual CISO firm. A retention policy sits where security, legal and operations meet, and it often has no owner. A virtual CISO can write the policy with your attorney, put the deletion and legal hold steps into the security program, and report on it to leadership. Elevaire Managed Security handles the technical side: backup retention, device management and confirming that deletions actually happen. For companies with a formal obligation, compliance readiness covers HIPAA, SOC 2 and CMMC requirements that include retention and disposal.

Example engagement: a 60-person accounting firm renews its cyber insurance and finds a new question asking how long client data is kept. Elevaire would work with the firm's attorney to set a schedule by record type, configure deletion in the document system and mailboxes, align backup retention with the schedule, and document the legal hold process before the application goes back.

Elevaire works alongside a company's existing IT provider. The IT team keeps running the systems, and Elevaire covers the security decisions and controls around them. The security baseline checklist shows where retention fits among the other basics.

Frequently Asked Questions

How long should a small business keep records?

It depends on the record type, and the answer is the longest period that applies. For tax records, the IRS generally points to three years from filing, and at least four years for employment tax. Contracts, personnel files and industry records can run longer under other laws, so confirm each period with your attorney and accountant.

What is the difference between a retention policy and a backup?

A backup is a copy kept so you can recover from data loss or an attack. A retention policy decides how long information is kept and when it must be destroyed. The two have to match, because a backup that keeps data for ten years undoes a policy that says seven.

Can we just keep everything forever?

Some companies do, but it raises exposure. Every old record is part of the damage in a breach, and some laws require deletion after a set period. Keeping everything also makes it harder to answer insurer and client questions about how data is handled.

How does this work alongside our existing IT provider?

Elevaire works alongside your IT provider or internal team and does not replace them. Your IT team keeps managing systems and tools. Elevaire sets the security requirements for retention and deletion, checks that they are applied and reports on them.

What does help with a retention policy cost?

Elevaire Managed Security and virtual CISO support use predictable monthly pricing, with no hourly billing. Compliance readiness projects are quoted up front. For market context, IBM's 2025 report put the average US data breach at $10.22 million, which is why many companies treat reducing stored data as worthwhile.

How do we get started?

Begin with an inventory of where company data lives, then list the record types and ask your attorney for the required period of each. The free Security and AI Risk Scorecard is a quick way to see where your current practices stand before you write the policy.