# Retention schedule: guidance

## Setting a period where no law sets one

Ask three questions:

1. **How long do we actually use it?** Look at when the information was last needed in practice.
2. **What could we need it for afterwards?** Handling complaints, defending a legal claim, answering an audit. Limitation periods for many civil claims are commonly around six years, which is often why organisations choose six or seven years for transaction records. Take advice if this matters.
3. **What's the harm if we keep it and it leaks?** The more sensitive the information, the stronger the case for a short period.

Write the reason in the schedule. "We might need it someday" isn't a reason.

## Making deletion happen

A schedule nobody runs is worse than none, because it shows you knew. For each record type:

- Name an **owner** responsible for disposal.
- Automate where you can, with retention policies in Microsoft 365 or Google Workspace, automatic CCTV overwrite, and scheduled deletion in your CRM.
- For manual disposal, set a recurring calendar reminder and record the date disposal was done.
- Include **backups** in your thinking. Information in a backup is still held. It's acceptable for backups to age out on their normal cycle, as long as you don't restore deleted information for new uses.
- Destroy paper by secure shredding, and wipe or destroy devices before disposal or resale.

## Legal holds

If you're aware of a likely legal claim, complaint, investigation or access request involving certain records, suspend disposal of those records until it's resolved. Deleting information to avoid an access request is an offence under the Privacy Act.

---
From Faraday, faraday.co.nz/templates/retention-schedule/ (CC BY 4.0). Checked against New Zealand sources on 19 October 2026. General information, not legal advice.