Most small businesses have no data retention policy. What they have instead is a habit: keep everything, forever, because storage is cheap and deleting things feels dangerous.
That habit has a cost, and it is not the storage bill. Every record you hold is a record that can be breached, subpoenaed, or leaked — and data you no longer need is pure liability with no offsetting value. A retention policy is how you decide, deliberately and in advance, what is worth that risk.
Why “keep everything” is the expensive option
Three things go wrong when nothing is ever deleted.
The first is breach scope. If an attacker reaches your file server, the size of the incident is determined by what is on it. A practice holding fifteen years of patient records has a fifteen-year notification problem. One holding seven has a seven-year problem, and the difference shows up directly in notification costs, regulatory exposure, and reputational damage.
The second is discovery. In litigation, you can be required to produce what you hold. Holding more means searching more, reviewing more, and paying counsel to do it.
The third is simply that nobody can find anything. Staff waste real time digging through a decade of superseded versions to locate the current one.
Start with what the law requires you to keep
A retention policy is built from the outside in. Legal minimums come first, then business need, then convenience.
The specifics depend on your industry and state, so verify these against your own counsel rather than treating them as gospel — but as an orientation for a typical Georgia or Alabama small business:
Tax and financial records generally want seven years, driven by IRS audit windows. Payroll and employment records are governed by a patchwork of federal rules — several years past termination is a common floor. Patient records in a dental or medical practice are set by state law and by the age of the patient, with minors’ records typically held well past the age of majority. Contracts are usually held for the life of the agreement plus the statute of limitations for a claim under it.
Write the actual number next to each category. “As long as required” is not a policy — it is a way of avoiding the decision.
Then decide what has no reason to persist
This is where the real risk reduction happens, because it is where most of the forgotten sensitive data lives.
Common candidates: job applications from candidates who were not hired (which contain plenty of personal data and rarely need to be kept beyond the relevant EEO window); credit card and bank details captured in email, which should never have been stored at all; old marketing lists of people who never became customers; former employees’ personal files left on a shared drive; and scanned intake forms that were already keyed into the practice management system.
One warning that matters: a legal hold overrides everything. If you know of pending or reasonably anticipated litigation, or an investigation, routine deletion stops immediately for anything relevant. Build that exception into the policy explicitly so nobody has to improvise.
Write it down in a form people can follow
A workable policy fits on two or three pages and answers five questions for each category of data: what it is, where it lives, how long it is kept, what triggers the clock (creation date, last patient visit, employment end date), and who is responsible for the deletion.
Assigning an owner is the step most policies skip, and it is why most policies are never executed. A retention schedule with no named owner and no calendar date is a document, not a control.
Make the systems enforce it
Anything that depends on someone remembering to delete files each quarter will fail. Push the rules into the tools.
In Microsoft 365, retention labels and retention policies can automatically delete — or automatically preserve — mail and documents by age or by label. Your practice management or line-of-business system likely has archival rules of its own. Automate what you can, then schedule an annual review for the parts you cannot.
Do not forget the backups
Deleting a file from the server does not remove it from four years of backup images. Your backup retention needs its own schedule, aligned with the policy — long enough to recover from a ransomware event that sat undetected for weeks, short enough that you are not silently carrying data you have formally deleted.
Getting that balance right is a genuine judgment call, and it is worth making it consciously rather than by default.
Where to start this week
Pick one category — old email attachments, or the shared drive folder nobody has opened since 2019 — and take it end to end: identify it, decide the retention period, delete what is past it, and set up the rule that keeps it clean going forward. One category done properly teaches you more than a policy document covering everything and enforcing nothing.
If you want help mapping where your data actually lives before you decide what to keep, reach out. That inventory is usually the eye-opening part.