---
id: KB-TZ-003
url: https://app.codecontract.io/help/traceability-and-compliance/how-long-to-keep-documents
idioma: en
categoria: trazabilidad
audiencia: administrador
nivel: intermedio
actualizado: 2026-08-13
tambienEn: [es]
relacionados: [KB-TZ-001, KB-AD-003]
citadoPor: [KB-AD-004, KB-MA-003, KB-DI-010, KB-CS-012, KB-TZ-013, KB-LE-020, KB-LE-022, KB-TZ-006, KB-GL-013]
---

# How long to keep documents

_Keeping too much also has a cost, and it is not storage._

**Responde a:** how long must documents be kept · data retention policy · delete old documents gdpr · obligation to retain contracts

Keeping everything forever looks prudent and is not: the more personal data you keep without reason, the greater the harm if something ever goes wrong, and the less defensible holding it is. The rule is to keep what must be kept, for as long as it must be kept.

**En corto**

- The period follows what the document is for, not the space it takes.
- Personal data with no reason to be there is a risk, not an asset.
- The policy is defined once and applies itself.

## Orders of magnitude

| Document type | Typically kept |
| --- | --- |
| Contracts and amendments | For the life of the relationship, plus the limitation period |
| Tax documentation | Whatever your tax rules require |
| Third parties' identity documents | The bare minimum; often verifying without storing is enough |
| Signature evidence | As long as the signed document has effect |

_Exact periods depend on your country and sector: this is the criterion, not the legal table._

> [!IMPORTANT]
> This is not legal advice. Exact periods are set by your regulations and your adviser; what the platform does is apply what you decide, consistently and on the record.

## What happens when the period is up

Whatever your policy says: deletion, or archiving without personal data. Either way there is a record that the rule was applied, which is what you need to be able to show.

> [!WARNING]
> If someone exercises their right to erasure, that sits alongside retention obligations: some documents must be kept by law even if the person asks for deletion. The policy is what resolves that in advance rather than case by case.

**Can periods differ by type?**

Yes, and that is the sensible approach.

**Is there a warning before deletion?**

A prior notice can be configured.

**What about ongoing litigation?**

Deletion of affected material is suspended. Deleting something relevant to live litigation is a serious problem.

## Ejemplos

**A company has kept copies of candidates' ID documents for eight years.**

- Defines that only those of people who were hired are kept
- Applies the policy to the backlog

→ It stops holding thousands of identity documents it had no reason to hold.

**Everything is kept indefinitely just in case.**

- Applies a retention policy by type

→ What is kept has a reason and a period.

**Something needed years later has been deleted.**

- Sets the periods with the adviser before deleting

→ Deleting stops being a gamble.

**Nobody knows how long each document type is kept.**

- Checks the applied policy

→ The decision is taken once and applies itself.

**A client asks how long you keep their material.**

- Answers with the written policy

→ The answer is specific.

**The archive grows without criteria.**

- Reviews what has passed its period

→ The archive stops growing unchecked.