Data Retention: How Long Should Documents Actually Be Kept?

Every piece of data kept indefinitely is data that remains exposed to a future breach indefinitely as well. A document that's genuinely no longer needed but still stored provides no ongoing value while still carrying ongoing risk.

This is a case where 'just in case' reasoning can quietly work against security rather than for it.

Certain document types, tax records, some contracts, specific regulated data, have legally mandated minimum retention periods. Those minimums are a starting point for a retention policy, not a reason to keep everything indefinitely once the requirement is satisfied.

Knowing which category a given document falls into is worth establishing clearly, since 'keep everything forever, just in case' and 'delete everything as soon as legally possible' are both simpler than the nuanced answer that actually fits most real documents.

A retention policy only matters if it's actually implemented, whether through automated deletion rules or a genuine recurring review process. A policy that exists only as a written document, with no enforcement mechanism, tends to default back to indefinite retention in practice.