Every organization that serves customers keeps records about them. An order history, a service log, a billing record, a support conversation: each is created for a purpose, and each is retained after that purpose is served. The question of how long is usually answered in a retention schedule — an internal document that sets a period for each class of record and describes what should happen when the period ends. We reviewed retention schedules, privacy notices, and disposal policies from a range of organizations that hold consumer records, and spoke with records managers about how those documents are written and applied. The question we set out to examine was not whether records are kept — they are, and often must be — but whether the schedule that governs them is one the organization can follow and the person the records describe can understand.
The documents we reviewed varied more in form than in principle. Some organizations publish a retention schedule a reader can consult, listing each class of record and the period that applies to it. Others describe their approach in general terms — records are kept as long as necessary for the purpose for which they were collected — without a table a reader could apply to a specific situation. A third group maintains a detailed schedule internally and does not publish it at all. None of these approaches is improper in itself. What differed was whether a person asking how long their information would be held could find an answer without putting the question to the organization directly.
Records managers described the pressures that shape a schedule. A record may be needed to honour a warranty, to answer a dispute, to satisfy a tax or licensing requirement, or to comply with a legal hold when a matter is anticipated. Each of those reasons carries its own period, and the longest applicable period tends to govern, which means a schedule is often set by obligation rather than by preference. Where a schedule is neglected, the practical default is accumulation: records are kept because no one has decided to remove them, and storage that was once inexpensive becomes a liability as it grows.
The individual's side of the arrangement is usually exercised through a request. In many jurisdictions a person may ask an organization what it holds about them, and in some may ask for it to be deleted. The organizations we reviewed described handling those requests through a defined process, with a period in which to respond and a set of exemptions — records that must be kept for a statutory or contractual reason, for example, or records connected to an ongoing dispute. Where a request is refused, the reason given is often a retention obligation the requester had no way to see in advance.
The distinction that matters is between retention that is justified and retention that is merely habitual. Keeping a record to meet a defined obligation is a decision someone made. Keeping it because disposal was never scheduled is the absence of one. In the documents we reviewed, the schedules that were easiest to explain were the ones that named the class of record, the period, the reason, and the person responsible for disposal — and whose owners could describe, without consulting the file, why each period was set where it was.
The practical questions are answerable from a retention schedule, if one can be found. Which records are held, for how long, and under what obligation? Who authorizes disposal, and what evidence is kept of it? How is a legal hold applied, and how is it released? What becomes of records held on the organization's behalf by a supplier or a hosting provider? For the person the records describe, the equivalent question is whether the organization will say, in writing, what it holds and how long it intends to keep it. In our review, the organizations that could answer those questions quickly were also the ones whose schedules were maintained rather than filed.