What to do with old business records before you destroy them

What to do with old business records depends on the type. Tax, payroll, personnel, Form I-9 and OSHA records have federal periods. Six operational record types do not, so the company sets the period. Check each for holds, ownership and licensing value, then destroy.

The six types run the company day to day: support tickets and chats, SOPs, the wiki, CRM history, project files, and internal chat and email. They are also the kinds of records an AI data buyer may license. This page covers US federal retention rules only.

What the federal rules say about operational records

As of November 2026, no general federal retention period turned up in the sources we checked for these records (OP-01 to OP-06, checked 2026-11-03). The company sets the period. That choice is the reason to stop and check before anything is destroyed.

Four limits still apply:

• A hold. Do not destroy a record that a pending or contemplated federal matter may need (DS-03). The federal statute, 18 U.S.C. 1519, covers knowing destruction of a record with intent to impede a federal matter, including one that is only contemplated. Personnel records relevant to a discrimination charge are held until final disposition (HR-03, 29 CFR 1602.14), and the employee records guide explains that clock.
• Tax support. A file that supports an item on a tax return carries that return’s period. The IRS default is 3 years from filing, and some cases run longer (TX-01 to TX-06). The business records guide lists them.
• The FTC disposal rule. Anyone who keeps consumer information for a business purpose must take reasonable measures against unauthorized access when disposing of it (DS-01, 16 CFR 682.3). The rule defines consumer information as a consumer report or information derived from one.
• Customer contracts. A contract can set its own terms for keeping or deleting what a customer gave you. Read it first.

The six operational record types

The table shows who sets the period and what to check before the records go. The last column is a flag. It marks a record of a kind that an AI data buyer may license, and it does not mean a given record qualifies.

Example: a company wants to delete support tickets from five years ago. Some carry invoices that support a 2026 return filed on 2027-04-15, and those invoices stay at least until 2030-04-15 (TX-01). The ticket text itself has no general federal period, so the company sets one after it checks for a hold and for customer-owned content.

What licensing company records involves

Some of these records may be worth more kept than destroyed, and a destroyed record cannot be licensed later, so the check comes first. A license is a contract, and five points decide what a company can offer and on what terms.

• Ownership. A company can license only what it owns or has the right to license. Under US copyright law, a work an employee creates within the scope of employment is a work made for hire, and the employer is its author (US Copyright Office, Circular 30). SOPs, wikis and project documents written by staff are usually the company’s on that basis. A contractor’s work counts as made for hire only if it falls into one of nine listed categories and both sides signed a written agreement saying so. Otherwise a signed transfer of rights gives the company ownership, so read each contractor agreement.
• License or sale. A license gives the buyer defined rights to use the records for a stated purpose and period, and the company keeps ownership. A sale transfers ownership itself. For copyrighted material, US law treats an exclusive license as a transfer of copyright ownership (17 U.S.C. § 101), and a transfer is not valid unless it is in writing and signed by the owner (§ 204(a)). A non-exclusive license falls outside that definition, so an exclusive license can work like a sale.
• Scope and exclusivity. The agreement says which records, for what use, for how long and whether the license is exclusive. An exclusive license stops the company from licensing the same records to others within its scope, and an exclusive, perpetual one can limit what the company does with them afterward.
• Personal data. Tickets, CRM history and internal messages hold names, contact details and other personal data. Privacy law, such as California’s CCPA and the EU’s GDPR, can apply to that data whatever a contract says. Who removes the personal data and who checks the result are terms of the agreement. Raw records that still hold personal data can count as a disclosure to the other company, so ask your lawyer what a transfer requires.
• Contracts, notices and tool terms. Customer contracts, NDAs and data processing addenda can restrict what the company may do with what a customer gave it, and so can the terms of its CRM, help desk and chat tools. A privacy policy is a promise too: the FTC has warned that quietly changing one to allow new uses such as AI training may be unfair or deceptive (FTC, February 2024). Read all of these before the company promises anything.

The buyer reviews the company and its records and decides whether to make an offer. Only the buyer can quote terms, and the agreement sets the payment terms.

Limits

• Not every company fits. We refer companies with 30 or more full-time employees in the markets the records check covers: the US, Canada, the UK and the EU. A smaller company, or one outside those markets, can still use every guide on this site.
• An offer is not guaranteed. The buyer decides whether to make an offer after it reviews the company and its records. Approval and payment are not guaranteed.
• The records check is a first screen. It asks four questions and does not look at your records. It cannot show that the company owns them, that the person answering can sign for the company, or that the buyer will make an offer.
• The company applies for itself. We do not submit applications. The company applies on the buyer’s site and answers the buyer’s questions itself.
• A license is a contract. Have the person who signs for the company and your lawyer read the terms before any records leave.
• Federal rules only. State law and contracts can limit what a company may do with its records, and this page gives no state periods.

Steps before you destroy operational records

1. Open the record retention schedule and note the federal period for every record group the company keeps.
2. List the operational records you plan to delete, using the types in the table above.
3. Check who owns each one. Look for customer-owned content, client work product, third-party material in the wiki and anything a contract or NDA restricts.
4. Check for a hold. Ask whether any audit, claim, charge, investigation or other federal matter is pending or contemplated.
5. If the company has 30 or more full-time employees, run the records check. It asks four questions and no files.
6. If you decide to destroy records, follow the secure document destruction checklist and keep the log.

Next steps

If you keep the records, write the period into your document retention policy: the record type, the start event, who decides and a review date. No federal rule names the start event for these records, so pick one you can show from the record itself, such as the date a ticket closed or a project ended. That is our recommendation.