Most $10M to $30M companies keep email, files, and chat history for as long as the system allows. Storage is cheap. Deleting feels risky. Keeping everything feels safer because the file will be there if someone asks for it later.
In practice, indefinite retention creates work you can measure. Old mailboxes hold customer data, pricing, payroll details, and internal discussions from years ago. Shared drives hold duplicate copies of the same contract, plus drafts nobody labeled.
A retention schedule gives each type of data a keep period, an owner, and a deletion method. You run it on a schedule. You document exceptions for legal holds and active matters.
What indefinite retention holds
Pull a sample from your own systems and look at what is actually there. In most companies I review, the oldest data falls into a few groups.
Email from employees who left three or four years ago, still stored in archive folders. HR files and payroll reports saved in general shared drives with broad access. Customer lists and proposals from old campaigns, copied into personal folders and synced to laptops. Chat and meeting recordings set to save automatically with no review date.
Each group carries access risk. Broad permissions from earlier reorganizations often still apply to old folders. A breach, a lost laptop, or a search by an AI assistant can surface material that the company had no business reason to keep.
Where the exposure shows up
Exposure shows up in three routine situations.
First, legal discovery. If the company faces a claim or a lawsuit, retained email and files are subject to review. A larger archive means more material for outside counsel to collect, review, and bill for. Old drafts and side comments become part of the record, even when the final decision was documented elsewhere.
Second, a security incident. Responders have to determine what data was in the affected mailbox or drive. A ten year archive takes longer to scope than a two year archive, and the notification analysis covers more people.
Third, daily operations. Staff waste time searching through duplicate and outdated versions. A sales rep pulls an old price sheet. Operations uses a procedure that was replaced last year. Keeping a single current version in a known location cuts that confusion.
Build a schedule from records you already have
Start with categories your company already uses for finance and operations. Your accountant and your insurer can tell you the periods they require for tax, payroll, and contract records in your state and industry. Use those periods as the floor for those categories.
For the rest, set a period based on business use. Active customer files stay for the life of the relationship plus the period your contracts require. Proposals for work you did not win can have a shorter period, for example two years after the decision. General email can have a defined period, for example two to three years, with a separate process for messages that belong in a contract file or a personnel file. The numbers will vary by company. The numbers need to be written, approved by leadership, and applied the same way each quarter.
Assign an owner for each category. HR owns personnel records. Finance owns payroll and tax records. Operations owns project files. IT applies the deletion rule and provides a report showing what was removed.
Include a legal hold step at the top of the process. When a matter is active, the owner pauses deletion for the relevant people and folders and documents the pause. Deletion resumes when counsel clears the hold.
Start with three actions this quarter
One, inventory the largest stores first: email archives, shared drives, and your main file platform. Record the owner, the date range, and the access list for each one.
Two, turn off automatic saving where there is no business need. Meeting recordings, temporary exports, and test data accumulate quickly and are rarely referenced after thirty to sixty days.
Three, run one deletion cycle and document it. Pick a low risk category, confirm the hold check, delete according to the schedule, and save the report. That first cycle gives leadership a concrete result to review before you expand to larger categories.
Review the schedule once a year, or when you change a major system. Retention works as a recurring operational task with a named owner and a report leadership can read.
Not sure where your IT really stands? Start with a Clarity Audit: a focused assessment of your backups, security, vendors, and AI readiness. It’s the first step in every engagement I take on.
About the author: Chris McGlasson is a fractional CIO and the founder of ClearStack Advisory, where he helps mid-market companies build AI governance, IT strategy, and technology roadmaps without the overhead of a full-time CIO. He previously built and sold LANPRO Systems, an IT services firm serving 350+ enterprise clients.