Data Retention Policy: How Mid-Market Owners and Operators Decide What to Keep and What to Delete

Data Retention Policy: How Mid-Market Owners and Operators Decide What to Keep and What to Delete

2026-10-29

Data you no longer need can’t help you, but it can still be stolen. The cheapest record to protect is the one you deleted on schedule.

That’s the job of a data retention schedule: a plain list of what data you keep, why, who owns it, and when it gets deleted. It shrinks what a breach can expose, and it’s now something federal regulators write into orders against companies that got it wrong.

Why “keep everything” stopped being free

Two Federal Trade Commission cases show where the line is moving.

Blackbaud. The FTC said a hacker exploited weaknesses in the software company’s network in early 2020, went undetected for three months, and removed large amounts of unencrypted sensitive consumer data belonging to Blackbaud’s customers. The FTC’s final order (May 20, 2024) requires Blackbaud to delete data it no longer needs and to put a data retention schedule in place. The order text gets specific: for customer backup files, the schedule must state the purpose, the business need, and “a set timeframe for Deletion” that rules out keeping data indefinitely, and it also covers former customers’ data.

Drizly. The FTC’s final order (January 10, 2023) against the alcohol delivery marketplace, after a breach the FTC said exposed data on about 2.5 million people, requires it to destroy personal data it doesn’t need and to collect or store personal information only for purposes listed in a retention schedule. The order also follows CEO James Cory Rellas: if he later becomes majority owner, CEO, or a senior officer with security duties at a business holding data on 25,000 or more consumers, he must put an information security program in place there too.

These are consent orders against specific companies, not a rule that binds everyone. But they show what the FTC considers reasonable, and that kind of language tends to show up in customer security questionnaires and insurance applications.

The FTC’s own small-business guide, Protecting Personal Information: A Guide for Business, boils data security down to five principles: take stock, scale down, lock it, pitch it, and plan ahead. A retention schedule is how you do “scale down” and “pitch it” on purpose instead of never.

Build your retention schedule in five steps

1. Inventory data types, not just systems

Start with categories: customer records, payment data, employee and HR files, job applicant resumes, email, backups, spreadsheet exports in shared drives, and data in software you stopped using. For each, note where it lives. This is the FTC’s “take stock” step, and it’s where most companies find their surprises.

2. Give every data type four answers

For each category, write down:

  • Purpose: why you collected it
  • Business need: why you still keep it
  • Owner: the person who answers for it
  • Deletion timeframe: a set period, never “indefinitely”

Those first and last columns mirror the language in the FTC orders above. Legal minimums (tax, employment, industry rules) come from your accountant and counsel; write the source next to each minimum so nobody has to guess later.

3. Don’t forget backups, exports, and old systems

The Blackbaud order specifically names customer backup files and former customers’ data. That’s where “deleted” data tends to live on: in backups nobody expires, in exports someone saved to their desktop, and in a system you migrated off but never shut down. When you leave a vendor, get their deletion confirmation in writing.

4. Make deletion automatic and boring

Use the retention settings built into your email, file storage, and business software wherever they exist. For the rest, put a quarterly purge on the calendar with a named owner. Build in one exception: a legal hold. Even the Blackbaud order lets the company keep data that law, regulation, or a court requires, including evidence for pending litigation. Your schedule should say who can place a hold and who lifts it.

5. Dispose of devices the right way

Deleting files isn’t the same as wiping a laptop. NIST SP 800-88 Revision 2 (published September 26, 2025) shifted its focus to setting up an organization-wide media sanitization program for disposal and reuse, and it keeps cryptographic erase (destroying the encryption key so encrypted data becomes unreadable) as a method for encrypted media (NIST summary of changes). Practically: encrypt company laptops from day one, and get written confirmation from your disposal vendor of the method they used.

Bonus: less data makes AI safer

AI assistants that search your files will happily surface the 2017 salary spreadsheet nobody remembered was shared. Trimming old data and fixing who can see what before you turn those tools on is cheaper than cleaning up after.

Quick wins for this month

  • Name an owner for your five biggest stores of personal data.
  • Delete stale exports and copies in shared drives.
  • Close out software you’ve stopped paying for, and get the vendor to confirm deletion.
  • Set a retention period on email and chat.

The bottom line

A data retention schedule is a one-page decision about what you’re willing to defend. Keep what has a purpose, delete the rest on a timer, and make sure backups follow the same rules.

An inventory of systems with owners is part of the Chief Information Officer work Yellow Coop offers, and a vendor risk review for the systems that hold your data is part of our Chief Information Security Officer work. See what we do and how we engage, or get in touch.

Sources