Data Retention Policy Template (US)
Updated on October 1, 2026
A data retention policy tells an organization what information it keeps, why it keeps it, where it lives, who owns it, how long it remains identifiable, and how it is deleted, archived or anonymized. The Jotform source talks about retention principles but never provides the most important item: a retention schedule by record type.
This US master turns the policy into an operational control. It includes record categories, legal bases, retention triggers, legal holds, deletion methods, backup treatment, vendor obligations, audit logs, exceptions and review cadence. It avoids the common overclaim that a generic policy is GDPR, HIPAA, GLBA or state-privacy compliant.
Tap any highlighted blank in the document below and type straight into it.Free — no sign-up, no watermark
Data Retention Policy Template (US)
- Organization:
- Policy owner:
- Effective date:
- Review cycle:
1. Scope and Record Inventory
This policy applies to records held by and managed by . Record categories, purposes and standard periods are:
2. Legal Holds and Exceptions
The ordinary schedule is suspended for records subject to a litigation hold, audit, investigation, regulator request or approved business exception. Legal hold process:
3. Disposal and Evidence
Approved disposal methods and evidence requirements are:
4. Backups and Vendors
Backup, archive, processor and vendor retention rules are:
5. Review and Approval
This policy is owned by and should be reviewed on the stated cycle, after a material legal or operational change, and after any serious incident that shows the policy no longer works in practice.
Approver
Date signed:
Start with a record inventory
A retention policy cannot work unless the business knows what it holds. The template begins with record categories, system of record, owner, purpose, sensitivity and legal or business reason for retention. This prevents the Jotform problem of writing broad principles without telling anyone what to keep.
The schedule should cover customer, employee, vendor, finance, marketing, product, security, support and legal records. For each category, the policy should state the start event for retention, the period, the disposal method and who approves exceptions.
Retention periods need reasons
A business should not keep personal data indefinitely just in case it becomes useful. The policy asks for the reason behind each period: contract performance, tax, audit, safety, employment, dispute limitation, regulatory duty or business need.
Where law does not provide a fixed period, the owner must justify the period and review it. The guide uses ICO storage-limitation principles because they explain the discipline clearly even when a US business is not directly under UK GDPR.
Legal holds override ordinary deletion
A retention policy that deletes records during litigation, investigation or regulator inquiry can cause serious harm. The template includes a legal-hold process: who can issue a hold, which systems are affected, how custodians are notified, and when the hold is released.
A hold should be narrow enough to preserve relevant records without freezing every system forever. The document includes exception approval so the policy can respond to real disputes without becoming useless.
Backups and vendors need their own rules
Many policies promise deletion while backups and processors keep copies indefinitely. This master adds backup-retention and vendor-return-or-deletion language. It recognizes that some backups cannot be selectively edited, but they still need expiry, access limits and restore controls.
Vendor contracts should align with the schedule. If a SaaS provider, payroll vendor, processor, archive or cloud backup retains data longer than the company policy allows, the business needs an exception or contract change.
Disposal must be evidenced
Deleting data is a control, not a vibe. The template asks for disposal method, system, date, responsible person and certificate or log where appropriate. For physical records, that may mean shredding or secure destruction; for digital records, deletion, anonymization or cryptographic erasure may be used depending on the system.
The policy also includes review cadence. Data maps change, products change and laws change. A stale schedule is one of the fastest ways for a retention policy to become misleading.
Clause and field guide
- Record category
- Names each type of record and the system or location where it is kept.
- Purpose and owner
- Explains why the record is kept and who owns the retention decision.
- Retention trigger and period
- States when the retention clock starts and how long the record is kept.
- Legal hold
- Suspends ordinary disposal for disputes, audits, investigations or regulatory requests.
- Disposal method
- States deletion, anonymization, archive, shredding or destruction method.
- Backups and vendors
- Explains how copies in backups and third-party systems are handled.
- Exceptions
- Requires approval and documentation for records kept longer or deleted earlier.
- Review cadence
- Keeps the policy aligned with laws, systems and business purposes.
US compliance checklist
Use this as a retention policy and schedule framework. It does not set universal retention periods or override litigation holds, sector rules or state privacy laws.
Document standard retention periods where possible
A retention policy or schedule should list record types, purpose and retention period, and should be reviewed in practice.
ICO storage limitation and retention policy guidanceDo not keep personal data indefinitely by default
Retention should be tied to purpose, legal duties or justified business need, not vague future usefulness.
ICO storage limitation and retention policy guidanceSuspend deletion under legal hold
A litigation, audit, investigation or regulator hold should pause ordinary disposal for affected records.
Align vendors and backups
Processor, SaaS, backup and archive retention should be checked against the policy.
Evidence disposal
Keep logs or certificates for important disposal events where practical.
How to use this template
- Inventory record categories. List the systems, record types, owner, sensitivity and business purpose.
- Choose retention periods. Tie each period to law, contract, limitation period, audit need or documented business purpose.
- Add legal hold handling. Define who can suspend deletion and how custodians are notified.
- Document disposal. State deletion, anonymization, shredding, archive or vendor deletion evidence.
- Review annually. Check systems, laws, vendors and purposes at least once a year and after major changes.
Frequently asked questions
Does the policy set exact legal retention periods?
No. It gives a structure for setting them. You must research sector, tax, employment, contract and state rules for each record category.
Can we delete records under a legal hold?
No. A legal hold should pause ordinary disposal for affected records until authorized release.
What about backups?
Backups should have their own retention, access and restore rules. Some cannot be selectively edited, but they still need expiry and controls.
Is anonymization the same as deletion?
Not always. It must be robust enough that individuals are no longer identifiable; otherwise the record may still be personal data.
Who owns retention?
Usually legal, privacy, records, security and system owners share responsibility. The policy should name an owner for each category.
How often should it be reviewed?
At least annually is common, and sooner after new systems, new laws, mergers, litigation or major business changes.
Related templates
Disclaimer
This template and guide are general information only, not legal, tax, employment, privacy, licensing, financial, safety, or childcare advice. No attorney has reviewed your facts, and nothing here is certified as compliant or approved by a regulator. Federal, state, local, industry, and contract rules differ and change. Check the current rules that apply to you and take professional advice before you sign, send, publish, or rely on this document.
