Most organisations keep everything forever, which is expensive, increases breach impact, and conflicts with data protection obligations. A retention schedule only works if it names a legal basis per record type and records that deletion actually happened.
Record the basis for every period. Each row needs a reason: a statutory requirement, a limitation period, a contractual obligation, or a stated business need. Rows without a basis are the ones that quietly become 'keep forever'.
Define the trigger, not the duration by itself. 'Seven years' is meaningless without saying seven years from what. End of contract, last transaction, employment end date. The trigger is what makes the rule automatable.
Log deletions as they happen. Under data protection regimes you may need to show that data was deleted when it should have been. A deletion log with dates, record counts, and method is the only practical evidence.
Here's a preview. Unlock the free download to get all 3 sections (2 more below).
| Record type | System | Classification | Retention period | Trigger | Legal / business basis | Disposal method | Owner |
|---|---|---|---|---|---|---|---|
| Customer contracts | Contract repository | Confidential | 7 years | End of contract | Limitation period for contractual claims | Secure deletion | Legal |
| Employee records | HR system | Confidential | 6 years | End of employment | Employment claims limitation | Secure deletion | Head of People |
More free templates IT teams use alongside this one.
Classification schemes fail when they produce labels without consequences. This one attaches concrete handling rules to each tier (where it may be stored, who may access it, whether it can leave the country), so the label changes what happens.
Most backup policies describe a schedule and stop. The clauses that decide whether you recover from ransomware are the ones usually missing: an immutable copy, an offline or logically-separated copy, and a stated obligation to test restores.
A SOC 2 Type II does not test whether you have a control. It tests whether the control operated throughout the period, and asks you to prove it with artefacts from specific dates. This tracker is organised around that reality: per control, per evidence artefact, per sample date.
Each record type with its system, classification, retention period, the trigger event the period runs from, the legal or business basis, the disposal method, and an owner, plus a deletion log evidencing that the schedule actually operates.
It increases storage and discovery costs, enlarges the impact of any breach, and conflicts with data protection principles requiring that personal data be kept no longer than necessary. Data you do not hold cannot be stolen or mistakenly disclosed.
Deleting a record from a live system leaves copies in backups until those rotate out. Document that gap and the maximum period before backup copies expire. Regulators generally accept this provided it is documented and bounded.
