# Records Retention & Disposition Schedule

> ISO 15489 (records management) – cross-standard utility: every MS
> clause 7.5 says "control documented information" but this is the
> schedule that says WHAT records, HOW LONG, WHERE, and WHEN destroyed.

| Field | Value |
|-------|-------|
| Document ID | DOC-RM-001 |
| Owner | Records/compliance |
| Legal basis check | legal register ref |
| Review | Annual |

## Retention schedule

| Record type | System/source | Owner | Retention | Trigger* | Storage | Protection | Disposition |
|-------------|---------------|-------|-----------|----------|---------|------------|-------------|
| Audit reports | QMS | @qa | 3 years | creation | doc system | access ctrl | certified destruction |
| Personnel records | HRIS | @hr | tenure + 7y | termination | HRIS | restricted | legal hold check |
| Financial records | ERP | @fin | 7 years | fiscal year end | ERP | restricted | archive |
| Contracts | legal | @legal | term + 6y | expiry | CLM | restricted | review then destroy |
| Security logs | SIEM | @sec | 1 year | creation | SIEM→archive | integrity | auto-delete |
| Customer data | product DB | @dpo | per privacy policy | account close | prod | encrypted | per deletion SOP |

*Trigger: event that starts the retention clock.

## Rules

1. Legal hold overrides schedule – suspend destruction when litigation
   is anticipated.
2. Retention = the LONGEST applicable period (legal > regulatory >
   contractual > business need).
3. Disposal records: what, when, method, authorized by – destruction
   is itself a record.
4. Electronic records: retention applies to readable formats –
   plan for format obsolescence.

## Disposal log

| Date | Records | Volume | Method | Authorized | Witness |
|------|---------|--------|--------|------------|---------|
| | | | | | |