Records Retention & Disposition Schedule
Retention & disposition schedule
How to use: Retention = longest applicable period, and legal hold suspends everything. The disposal log is itself a record – destruction must be provable.
Preview
Records Retention & Disposition Schedule
ISO 15489 (records management) – cross-standard utility: every MS clause 7.5 says "control documented information" but this is the schedule that says WHAT records, HOW LONG, WHERE, and WHEN destroyed.
| Field | Value |
|---|---|
| Document ID | DOC-RM-001 |
| Owner | Records/compliance |
| Legal basis check | legal register ref |
| Review | Annual |
Retention schedule
| Record type | System/source | Owner | Retention | Trigger* | Storage | Protection | Disposition |
|---|---|---|---|---|---|---|---|
| Audit reports | QMS | @qa | 3 years | creation | doc system | access ctrl | certified destruction |
| Personnel records | HRIS | @hr | tenure + 7y | termination | HRIS | restricted | legal hold check |
| Financial records | ERP | @fin | 7 years | fiscal year end | ERP | restricted | archive |
| Contracts | legal | @legal | term + 6y | expiry | CLM | restricted | review then destroy |
| Security logs | SIEM | @sec | 1 year | creation | SIEM→archive | integrity | auto-delete |
| Customer data | product DB | @dpo | per privacy policy | account close | prod | encrypted | per deletion SOP |
*Trigger: event that starts the retention clock.
Rules
- Legal hold overrides schedule – suspend destruction when litigation is anticipated.
- Retention = the LONGEST applicable period (legal > regulatory > contractual > business need).
- Disposal records: what, when, method, authorized by – destruction is itself a record.
- Electronic records: retention applies to readable formats – plan for format obsolescence.
Disposal log
| Date | Records | Volume | Method | Authorized | Witness |
|---|---|---|---|---|---|