Data Retention Policy: How Long Should a Small Business Keep Email and Files?

A data retention policy says how long each type of business record is kept and when it is deleted. Most small businesses do not have one, which in practice means everything is kept forever. That feels safe, but it is not: every old email and file is something an attacker can steal, something you must notify people about after a breach, and something you may have to search and produce in a lawsuit. Deleting too soon is a problem too, because many records have legal minimums. A simple written policy, enforced by your systems, handles both.

This article is general guidance, not legal advice. Retention rules depend on your industry and state, so confirm your schedule with your attorney and accountant.

Examples of common requirements

  • Tax records. The IRS generally expects records supporting a return to be kept for at least three years, longer in some situations, and employment tax records for at least four years.
  • Payroll and hiring. Federal wage-and-hour rules require payroll records for three years, and Form I-9 must be kept for three years after hire or one year after employment ends, whichever is later.
  • HIPAA documentation. Covered entities must keep required HIPAA policies and documentation for six years. Medical record retention itself is set by state law.
  • Industry and contract rules. Financial services, government contractors, and others have their own requirements, and client contracts may specify retention too.

Build the policy in five steps

  1. List your record types. Contracts, invoices, payroll, HR files, client files, email, quotes, marketing material, and anything regulated.
  2. Assign a retention period to each, based on legal requirements and real business need. Where there is no requirement, choose a period you can justify.
  3. Name where each type lives. SharePoint site, accounting system, HR platform, mailbox. Records scattered across desktops and USB drives cannot follow any policy.
  4. Define how deletion happens, automatically wherever possible, and who approves exceptions.
  5. Write down the legal hold process. When litigation or an investigation is likely, deletion must stop for the affected records. Everyone who manages data needs to know how that works.

Enforcing it in Microsoft 365

Microsoft Purview retention policies can keep content for a set period, delete it after a set period, or both, across Exchange email, SharePoint, OneDrive, and Teams. For example, a business might keep all email for seven years and then delete it, keep HR site content for a set number of years after an employee leaves, and remove Teams chat messages after a shorter period. Retention labels let people mark specific documents, such as contracts, with their own schedule. Litigation holds and eDiscovery holds preserve everything for a specific person or case, overriding normal deletion until the hold is released.

Configure these carefully: a retention policy that deletes content does exactly what it says, across the whole organization. Test on a small scope first and document what each policy does.

Retention is not backup

Retention decides what is kept and for how long; it does not give you a quick way to roll back after ransomware, a sync accident, or a malicious admin. You still need a separate backup. We explain the difference in why native retention is not enough.

Do not forget departed employees

When someone leaves, their mailbox and OneDrive often contain records you are required to keep. Converting a departed employee’s mailbox to a shared mailbox, or using an inactive mailbox under a retention policy, preserves it without paying for a license, and OneDrive files should be moved to a business-owned location before the account is removed. Build these steps into your offboarding checklist.

Old data is a liability

The quiet benefit of a retention policy is data minimization. A former customer’s credit application from twelve years ago does nothing for your business, but if it is stolen, you may have to notify that customer. Deleting what you no longer need, on a schedule, shrinks the damage any breach can do.

Get a retention policy that runs itself

Equal Tech Solutions helps businesses across Cleveland, Chattanooga, and the Southeast write a practical retention schedule with our vCIO services and enforce it in Microsoft 365 with our cloud services. Contact us to get started.