Anchor Cyber Security · anchorcybersecurity.com
Data Retention & Disposal Policy
[Organization Name] · Effective Date: [Date] · Version 1.0 · Approved by: [Name, Title]
1. Purpose & Scope
This policy defines how long [Organization Name] retains different categories of records and data, and how that data is securely disposed of once its retention period ends. It applies to data in any format — physical and electronic — across all systems and storage locations the organization controls.
2. Definitions
- Record: Any document or data created or received in the course of business, regardless of format.
- Retention Period: The length of time a record must be kept before it is eligible for disposal.
- Legal Hold: A directive suspending normal disposal of specific records because of actual or reasonably anticipated litigation, investigation, or audit.
- Sanitization: The process of removing data from media such that it cannot be feasibly recovered, per NIST SP 800-88 Rev. 1's Clear, Purge, and Destroy categories.
3. Data Classification Reference
Retention and disposal requirements below assume the organization's existing data classification scheme (e.g., Public / Internal / Confidential / Restricted). If no formal scheme exists yet, treat any PHI, PII, financial, or credential data as the highest sensitivity level by default.
4. Retention Schedule
| Record / Data Type | Retention Period | Basis | Owner |
|---|---|---|---|
| Financial / tax records | 7 years | Tax basis (consult your accountant for your jurisdiction) | [Finance] |
| HIPAA compliance documentation (policies, risk analyses, incident records) | 6 years from creation or last effective date | 45 CFR §164.316(b)(2) — this is a floor for compliance documentation, not for PHI itself; PHI retention is governed by state law | [Compliance] |
| Security logs | 12 months (adjust to your monitoring/compliance needs) | Operational / industry practice | [IT/Security] |
| Contracts | Duration of contract + [7] years | Statute of limitations considerations | [Legal] |
| Customer data | Per the applicable contract or DPA terms | Contractual | [Data Owner] |
| Employee records | Duration of employment + [7] years | State/federal employment law varies | [HR] |
This schedule is a starting point, not a complete legal determination — have counsel confirm retention periods for your specific industry and the states/countries you operate in before finalizing.
5. Legal Hold Process
When [Legal] issues a legal hold notice, normal disposal of the specified records is suspended immediately, regardless of where that record falls in the schedule above. The hold remains in effect until [Legal] formally releases it. Employees notified of a legal hold must not delete, alter, or dispose of the covered records.
6. Secure Disposal Methods by Media Type
| Media Type | Method | Standard |
|---|---|---|
| Paper documents | Cross-cut shred or certified destruction service | — |
| Hard drives / SSDs (reused internally) | Purge (cryptographic erase or vendor-specific secure erase) | NIST SP 800-88 Rev. 1 |
| Hard drives / SSDs (end of life) | Destroy (physical destruction — shred, disintegrate, or degauss for magnetic media) | NIST SP 800-88 Rev. 1 |
| Cloud-stored data | Cryptographic erasure or vendor deletion confirmation | NIST SP 800-88 Rev. 1 |
7. Disposal of Third-Party-Held Data
Where a vendor holds [Organization Name]'s data on its own systems, confirm the vendor's contractual obligation to delete or return that data on contract termination, per the organization's Vendor Management Policy. Request written confirmation of deletion for any Critical-tier vendor relationship.
8. Verification & Documentation of Disposal
Maintain a disposal log recording what was disposed of, when, by whom, and by what method. For physical destruction of media containing regulated data, retain a certificate of destruction from the service provider.
9. Roles & Responsibilities
Each record owner listed in Section 4 is responsible for ensuring their category's records are disposed of on schedule. [IT/Security] owns the technical sanitization/destruction process and the disposal log.
10. Exceptions
Any deviation from this schedule, other than an active legal hold, must be documented and approved by [Legal/Compliance].
11. Policy Review
This policy is reviewed at least annually and following any material change to applicable retention laws or the organization's data footprint.
This template is a starting point, accurate as of October 2026. Retention periods vary significantly by jurisdiction and industry — confirm the figures in Section 4 with counsel before adopting them.
Maps to: NIST SP 800-88 Rev. 1 · CIS Controls v8.1 Safeguards 3.1, 3.4, 3.5 · ISO/IEC 27001:2022 Annex A.5.33, A.8.10 · HIPAA Security Rule §164.310(d)(2), §164.316(b)(2) · PCI DSS v4.0 Req. 3.2.1 · CMMC 2.0 / NIST SP 800-171 MP.L2-3.8.3
Questions? Schedule a free consultation: anchorcybersecurity.com/contact · © Anchor Cyber Security LLC