A data retention schedule is the documented answer to how long each category of information is kept and what happens to it afterward. For employers it sits at the intersection of two opposing pressures: record-keeping laws that require holding certain documents for years, and privacy principles that penalize holding anything longer than necessary.
The default in most organizations — keep everything forever — satisfies the first pressure and fails the second, while quietly maximizing breach exposure with every passing year.
Employment records run on mandatory minimums: payroll records, timekeeping data, tax filings, I-9s, safety and exposure records, benefits documentation, and hiring records each carry required periods, some extending years past separation and a few — certain safety records — measured in decades.
Privacy frameworks run the clock the other way. For covered California employers, retention periods or the criteria for setting them must be disclosed at collection, and the underlying principle is that data should not outlive its purpose. Indefinite retention is difficult to square with that, and impossible to disclose honestly.
The schedule is the reconciliation: for each category, the retention period is the longest applicable legal minimum plus any genuine business need — and then deletion actually happens.
Every retained record is standing exposure. A breach reaches back through everything still held, so an employer keeping twenty years of personnel files has a breach twenty years wide. Rights requests must search everything still held. Litigation discovery reaches everything still held. And storage sprawl means nobody knows where it all is.
Deletion on schedule is also a defensible position in a way ad hoc deletion never is. Records disposed of under a documented, consistently applied schedule raise no inference; records deleted selectively, after a dispute surfaces, raise the worst one available. The schedule is what makes disposal safe.
The copies clause is where schedules fail in practice. Deleting a record from the HRIS while it lives on in three exports and an inbox is compliance theater. Retention discipline and export discipline are the same project.
Applicant data — the largest unmanaged category almost everywhere. Selection records carry required minimums, but the thousands of never-hired candidates accumulating indefinitely serve no purpose and support no defense. A defined period, disclosed to candidates, with automatic disposal, is the fix.
Medical information — separate storage, separate access, and in some cases long mandatory periods. The schedule should treat it as its own line, never merged with personnel files.
I-9s — a precise formula: three years after hire or one year after separation, whichever is later. A single blanket period gets this wrong in both directions.
Investigation records — retention driven by limitation periods for the claims they may bear on, which usually argues for longer than instinct suggests.
The schedule needs one master exception: when litigation is pending or reasonably anticipated, disposal of potentially relevant records stops, immediately and documentedly. Destruction on schedule is defensible; destruction on schedule after a claim was foreseeable is spoliation.
The practical mechanism is a named person with authority to issue a hold, a defined way the hold reaches everyone who deletes things — including automated disposal jobs — and a record of when the hold was placed and released.
A schedule written once and shelved drifts out of truth within a couple of years — new systems arrive, laws change, categories appear. An annual review, an owner for the document, and disposal that runs as routine rather than as an occasional purge are what separate a working schedule from a binder.
Employer's Guardian helps employers build retention schedules that reconcile record-keeping mandates with privacy obligations, and put disposal into practice through HR liability management.
This article provides general educational information, not legal advice. Retention requirements vary by jurisdiction and record type. Consult qualified counsel before adopting or executing a disposal schedule.