Data retention policy for US companies

A data retention policy sets how long each category of data stays in your systems and how it is deleted. A document retention policy covers records as documents. This one covers systems: databases, email, chat, files and backups. It uses US federal rules only.

How the data policy fits with the document policy

The federal periods attach to the record. A payroll register is kept for the same time whether it sits in a filing cabinet, a payroll system or a backup. So the data policy starts from the schedule in your document retention policy: each category of data is kept as long as the longest record it contains.

The data policy adds what the schedule cannot. It says which system holds the data, who owns that system, how deletion works there, and when the rule is next reviewed. The sources we checked do not say a company must have a written data retention policy.

Where the sources allow electronic storage

Three sources say electronic copies are acceptable, and each sets conditions:

• Tax records. IRS Publication 583 says original hard copies of books and records may be destroyed once the electronic storage system has been tested and procedures keep it compliant (DS-02). The same retention periods apply to the electronic copy.
• Form I-9. It may be kept on paper, electronically, or on microfilm or microfiche. The regulation sets requirements for electronic storage.
• Benefit plan records. They can be kept on electronic media if the conditions in 29 CFR 2520.107-1 are met.

Record in the policy which system holds the official copy of each category. If the system is retired, the retention period does not end with it.

Email retention policy

As of November 2026, no federal rule we found sets one period for email. Three points follow from the rules we did find:

• An email that is part of a record in the schedule is kept as that record. An invoice sent by email follows the invoice period (TX-01).
• A message that forms part of a personnel or employment record follows HR-01 to HR-03 (OP-06).
• A hold covers email too. Do not destroy a message that a pending or contemplated federal matter may need (DS-03).

For all other email, the company sets the period, within the limits of holds, contracts and state law. Write the default for each kind of mailbox into the table in the template below.

Chat messages and shared files follow the same logic. One that is part of a record in the schedule is kept as that record, and a hold covers it. Anything else is kept for the period the company sets, or marked “review before deleting”.

Data retention policy best practices

These steps are ours. They are working practice and no agency rule.

1. List every system that holds company data: databases, email, chat, file storage, CRM, ticketing, the wiki and backups.
2. Name an owner for each system.
3. Map each category of data to a row of the schedule, or mark it “review before deleting”.
4. Set the deletion method for each system, backups included.
5. Turn off automatic deletion for any data under a hold, and say who can turn it back on.
6. Set a review date, and record each change to the policy.

Example: three filled rows of the retention table.

“Review before deleting” means the owner checks four things before data goes: a hold, tax or employment records inside the data, the FTC rule on disposing of consumer information (DS-01), and customer contracts.

Backups and copies

Backups keep copies of data after it is deleted from the live system. Decide how long backups are kept and write that period into the table. Check whether a hold reaches your backups before the next rotation overwrites them. When a retention period ends, the copy in the backup needs a deletion date too, so the record is gone from every place it sits.

Data retention policy template

Copy the template into your own document and replace each bracketed field. It states no retention period. Each period belongs in the schedule, with its rule and source.

Deleting data and sanitizing media

Deleting a file in a system is not the same as sanitizing the storage underneath it. NIST publishes SP 800-88 Rev. 2, Guidelines for Media Sanitization, dated September 2025, which supersedes Rev. 1. It helps organizations and system owners set up a media sanitization program with techniques and controls for sanitization and disposal based on the sensitivity of their information. Our secure document destruction guide covers destruction logs and certificates.

Privacy law and other countries

This page covers US federal rules. State privacy laws can add duties on personal data in your systems, so check your state. EU and UK data protection rules are separate and this page does not cover them. In the UK the regulator is the Information Commissioner’s Office. The European Data Protection Board lists the EU’s national authorities.

Data you plan to delete may be an asset

Operational data has no general federal retention period in the sources we checked, so the company decides when it goes: support histories, SOPs, project files, CRM activity and internal messages. Before you set a deletion rule for them, check whether they could be worth more kept.

Read what to check before you destroy company records first.

Next steps

Start with the record retention schedule generator so each category of data has a rule behind it. The business records guide explains how the periods fit together.