Overview
Retention is not keeping everything forever. It is a defensible schedule plus the evidence that you followed it — and legal hold is the exception that must override deletion without losing the audit trail.
What a retention schedule actually decides
The schedule is not a storage policy. It assigns a record class, a retention period, a trigger, and a disposition action; keep everything forever is not a schedule. A schedule is a decision about what not to keep.
The trigger matters: creation, receipt, contract close, employee departure, investigation. A period without a trigger is ambiguous. The period starts when the trigger fires, not when the folder was created. A schedule without a trigger is a wish; a trigger without an owner is a rumour.
Legal hold is an exception: it suspends disposition for specific records and custodians. It must be documented, scoped, and released. The hold must be visible to the people who delete, not only to legal.
- Class — contract, board, clinical, inspection.
- Trigger — the event that starts the clock.
- Disposition — delete, transfer, or archive.
Legal hold: the exception that must not break the chain
A hold needs a matter, a scope, a custodian list, a date, and an owner. It must reach every copy: email, shared drive, endpoint, archive, backup. Map the copies before the first hold notice; after the hold, discovery is expensive. The hold should reach the archive and the backup, not only the shared drive.
A notice alone is not the control. Legal hold is not a folder; it is a workflow that overrides deletion and records who acknowledged it. Acknowledgement is evidence; silence is not consent.
Release is as important as preservation: keep the release memo, the date, and the evidence that disposition resumed. A released hold should leave a trail that shows disposition resumed under the schedule. Release without evidence is how a hold becomes a permanent archive.
- Matter — the legal context and owner.
- Scope — records, custodians, date range.
- Acknowledgement — who received and understood.
- Release — memo, date, resumed disposition.
Deletion you can defend
Disposition should produce a certificate: what was deleted, under which schedule, approved by whom, when, and from which systems. The certificate should name the schedule, the approver, the system, and the date; a screenshot of a folder is not a certificate. Name the system of record for each copy.
Secure deletion is a process, not a button. A delete key is not a disposition record. The certificate is what survives an audit. Deletion without a certificate is indistinguishable from loss.
Backups complicate everything; define how long copies persist and how holds apply to them. NARA records management and NIST SP 800-53 are useful references. Test a backup restore before you promise a retention period; the backup is part of the record. Backups are copies; if the hold does not reach them, the hold is incomplete.
- Approval — who authorized disposition.
- Evidence — certificate, hash, system log.
- Backups — retention and hold coverage.
- Exception — what was not deleted and why.
A practical matrix
Start with five classes: contracts, board materials, clinical records, inspections, and email. For each, write trigger, retention, hold behavior, and evidence. Add the owner and the evidence column; a matrix without owners is a poster.
The matrix is a decision tool, not a legal opinion; counsel owns the periods, security owns the evidence. Legal owns the period, security owns the proof, records owns the inventory. Write the matrix with the people who will defend it.
Test one disposition end to end: find every copy, apply the hold check, delete, and export the certificate. If the test takes a week, the process is not operational.
- Contracts — close date, 7 years, hold, certificate.
- Board — meeting date, permanent, hold, archive.
- Clinical — patient record, legal minimum, hold, access log.
- Inspections — asset, regulatory period, hold, evidence.
Checklist before the next audit
Pick one record class and one legal hold. Walk the lifecycle. If the certificate cannot be produced, retention is a story. Bring the certificate to the test, not the policy. A policy that cannot be tested is a preference.
- Inventory — where every copy lives.
- Schedule — class, trigger, period.
- Hold — scope, notice, acknowledgement, release.
- Test — one disposition, one certificate.
Retention becomes defensible when the schedule, the hold, and the deletion evidence are designed together. Start with the records an auditor or regulator will ask for first, then expand. If retention and legal hold are part of your document program, request a demo and bring one record class. For the public-records side, see transparency without leaks; for the evidence chain, see digital chain of custody; for tracking, see document tracking that proves custody. The test is simple: ask for one record and its disposition certificate.