Traceability and compliance
How long to keep documents
Keeping too much also has a cost, and it is not storage.
Keeping everything forever looks prudent and is not: the more personal data you keep without reason, the greater the harm if something ever goes wrong, and the less defensible holding it is. The rule is to keep what must be kept, for as long as it must be kept.
Orders of magnitude
| Document type | Typically kept |
|---|---|
| Contracts and amendments | For the life of the relationship, plus the limitation period |
| Tax documentation | Whatever your tax rules require |
| Third parties' identity documents | The bare minimum; often verifying without storing is enough |
| Signature evidence | As long as the signed document has effect |
Important
This is not legal advice. Exact periods are set by your regulations and your adviser; what the platform does is apply what you decide, consistently and on the record.
What happens when the period is up
Whatever your policy says: deletion, or archiving without personal data. Either way there is a record that the rule was applied, which is what you need to be able to show.
Watch out
If someone exercises their right to erasure, that sits alongside retention obligations: some documents must be kept by law even if the person asks for deletion. The policy is what resolves that in advance rather than case by case.
›Can periods differ by type?
Yes, and that is the sensible approach.
›Is there a warning before deletion?
A prior notice can be configured.
›What about ongoing litigation?
Deletion of affected material is suspended. Deleting something relevant to live litigation is a serious problem.
A real case
The situation
A company has kept copies of candidates' ID documents for eight years.
What you do
- Defines that only those of people who were hired are kept
- Applies the policy to the backlog
What you get
It stops holding thousands of identity documents it had no reason to hold.
The situation
Everything is kept indefinitely just in case.
What you do
- Applies a retention policy by type
What you get
What is kept has a reason and a period.
The situation
Something needed years later has been deleted.
What you do
- Sets the periods with the adviser before deleting
What you get
Deleting stops being a gamble.
The situation
Nobody knows how long each document type is kept.
What you do
- Checks the applied policy
What you get
The decision is taken once and applies itself.
The situation
A client asks how long you keep their material.
What you do
- Answers with the written policy
What you get
The answer is specific.
The situation
The archive grows without criteria.
What you do
- Reviews what has passed its period
What you get
The archive stops growing unchecked.
This article answers
- how long must documents be kept
- data retention policy
- delete old documents gdpr
- obligation to retain contracts