How to Create a Document Retention Schedule, Step by Step

A document retention schedule is a list of every kind of record your organization keeps, how long each must be kept, the event that starts the clock, and what happens when the period ends: destruction, transfer to an archive, or permanent keeping. To create one, you inventory your records, group them into record series, find the legal and business requirement for each, define the trigger and the disposition action, plan for legal holds, get the schedule approved, and then apply it where the records actually live. This guide walks through each step and gives you a template with the columns a schedule needs.

What a Retention Schedule Contains

Each row of a schedule is a record series: a group of records created and used for the same purpose, such as supplier contracts, employee files or project correspondence. Use these columns:

Step 1: Inventory Your Records

List what each department creates, receives and keeps, and where it is stored: shared drives, email, paper files, line-of-business systems and any document management system. Talk to the people who do the work. They know which records matter, which copies are duplicates and which spreadsheets everyone depends on.

Step 2: Group Them into Record Series

Group records by what they are for, not by who happens to hold them. Supplier contracts in purchasing, legal and finance belong to one series, with one retention rule. Keep the number of series manageable: a schedule with hundreds of rows will not be followed.

Step 3: Find the Requirement for Each Series

Retention periods come from laws and regulations, from contracts, from industry standards and from your own business needs. They differ by country, state, sector and record type, so this guide does not suggest periods.

• Take each period from its source, or from your legal counsel or records authority, and write the citation in the Authority column.
• Public bodies usually have general retention schedules issued by their national or state archives authority. Start from those.
• Where several requirements apply, the longest one usually wins. Note why in the schedule.
• Where there is no legal requirement, set a period based on business need and say so. "Business need" is a legitimate authority, as long as it is written down.
• Personal data should not be kept longer than its purpose needs. Under the GDPR this is the storage-limitation principle, and it is a reason to set end dates, not to keep everything.

Step 4: Define the Trigger

Most retention periods run from an event, not from the day a document was created: the end of a contract, the close of a project, the completion of an audit, an employee's departure. That event is the cut-off date. Write it into the schedule for every series, and decide who records it when it happens. A period without a defined trigger cannot be applied.

Step 5: Decide What Happens at the End

For each series, choose the disposition action: destroy, transfer to an archive, or keep permanently. Then decide how destruction is approved. Records should be reviewed before they are destroyed, by someone who can confirm that nothing requires them to be kept longer, and the decision should be recorded: what was destroyed, when, under which schedule line and on whose approval. That record is what makes deletion defensible.

Step 6: Plan for Legal Holds

When litigation, an investigation or an audit is reasonably expected, relevant records must be preserved even if their retention period has ended. A legal hold suspends destruction for those records until it is released. Your schedule should say who can place and release a hold, and your disposition process should check for holds before anything is destroyed.

Step 7: Approve, Apply and Review

• Approve it. Get sign-off from legal counsel, the records owner of each series and senior management. Keep the approved version, and version every later change.
• Apply it where the records live. A schedule kept in a binder or a spreadsheet is a policy, not a control. Map each series to the folders or systems that hold it, so the rule follows the records.
• Train the record owners. People need to know which series their documents belong to and when to record a trigger event.
• Review it regularly. Laws, contracts and the business change. Review the schedule at least once a year, and whenever a new kind of record appears.

Common Mistakes

• Keeping everything forever. It feels safe, but it increases storage, search effort and exposure in litigation, and it conflicts with privacy rules on personal data.
• Periods without a source. A period nobody can justify will be challenged, by an auditor or in court.
• Periods from the creation date. Most requirements run from an event. Counting from the creation date destroys some records too early and keeps others too long.
• No proof of destruction. If you cannot show what was destroyed, when and on whose approval, the deletion is hard to defend.
• Too many series. If staff cannot tell which row a document belongs to, the schedule will not be followed.
• A schedule that lives in a document. If nothing applies it to the records, it depends on people remembering.

Applying a Retention Schedule in infoRouter

infoRouter's Compliance module, licensed separately, applies a retention schedule to the records themselves:

• Schedules on folders and documents. A retention schedule is set on a folder or a document, and every document filed in a folder inherits the folder's schedule. Design your folders around your record series, and the schedule follows each record as it is filed. Our guide to creating a great folder structure helps with the layout.
• Cut-off dates start the clock. Users apply the cut-off date when the trigger event happens, and the retention period runs from that date.
• Protected until the period ends. A document under a retention schedule cannot be deleted by users. Only an authorized administrator can remove a schedule early, and that action is logged.
• Disposition with review. When a period ends, the record goes through a disposition review before anything is destroyed, and every decision is logged. Disposition reviews use Workflow, also licensed separately.
• Legal holds. A legal hold blocks destruction for as long as it applies.
• An audit trail on every document. Version control and audit trails come with every license.

See retaining and archiving records and records management software for how these work. infoRouter supports compliance with retention requirements; meeting them also depends on your own schedule, policies and how you configure and use the system.

Try It with Your Own Schedule

Request a Guided Trial. We set up an evaluation with you, in the cloud or on your own server, with the Compliance module and infoRouter Connect included, so you can map a few of your record series to folders and see a schedule run.