Retention Schedules and Legal Compliance in Records Management

A retention schedule is a document that specifies how long different categories of records should be kept and what should happen to them at the end of that period — whether disposal, transfer to an archive, or review. For organisations operating in Europe, building a defensible retention schedule means drawing on several overlapping layers of legal obligation: GDPR, sector-specific EU directives, and national legislation.

This article covers the structure of a retention schedule, the legal sources that inform retention periods, and the operational aspects of applying schedules to day-to-day records disposal.

Records preservation and storage facility

What a Retention Schedule Contains

A retention schedule is typically structured as a table or register with entries for each category of record the organisation holds. Each entry should include:

Record category: A descriptive title, e.g., "Employee personnel files" or "Supplier invoices"
Retention period: The length of time the record must be kept, usually expressed in years after a trigger event (e.g., end of employment, completion of contract)
Legal basis: The specific regulation, directive, or statute that requires or permits this retention period
Disposal action: What happens at the end of the retention period — secure destruction, transfer to archive, or review
Responsible function: Which department or team is responsible for applying the schedule to records in their area

GDPR and the Storage Limitation Principle

Article 5(1)(e) of GDPR requires that personal data is kept no longer than necessary for the purposes for which it was collected. This is the storage limitation principle, and it applies equally to personal data held in paper records and digital records.

The practical implication is that every category of records containing personal data needs an identifiable purpose and a defined period after which that purpose is spent. GDPR does not prescribe specific retention periods — these are determined by the purpose, informed by other applicable law. GDPR Article 5(1)(e) expressly permits longer retention for archiving purposes in the public interest, scientific or historical research, or statistical purposes, subject to appropriate safeguards.

The European Data Protection Board (EDPB) has published guidance on the interaction between GDPR and national archiving legislation. The relevant guidance documents are available on the EDPB website.

Sector-Specific Retention Requirements in the EU

Several EU directives impose specific record-keeping obligations on particular sectors. These obligations must be reflected in the retention schedule of any organisation operating in the relevant sector:

Financial and Accounting Records

EU accounting directives require that accounting records be kept for defined minimum periods. Most member states have transposed these into national company law with minimum retention periods — commonly in the range of six to ten years — for invoices, ledgers, and related documentation.

Employment Records

Employment law varies considerably across member states, but most require retention of payroll records, employment contracts, and health and safety documentation for defined periods after the employment relationship ends. Some jurisdictions require longer retention for pension-related records.

Healthcare Records

Healthcare record retention is governed primarily at national level, but EU directives on cross-border healthcare (2011/24/EU) create additional considerations for records relating to treatment provided across member state borders. Retention periods for patient records across EU member states range broadly — from ten years to the patient's lifetime and beyond in some national frameworks.

Legal and Contract Records

The applicable limitation period for contract disputes under national law is a key driver for retention of contracts and correspondence. Most EU member states have general limitation periods in the range of three to ten years, with some specialist areas requiring longer retention.

Applying the Schedule: Trigger Events

The retention period for a record almost always runs from a trigger event, not from the date the record was created. Common trigger events include:

End of employment (for HR records)
Completion or termination of a contract (for commercial records)
End of the financial year to which the document relates (for accounting records)
Date of the last clinical contact (for healthcare records)
Date a legal action was resolved (for litigation-related files)

Because trigger events are not always easy to identify in a large volume of records, some organisations adopt a simplified approach: retaining records for a fixed period from the date of creation or receipt. This approach sacrifices some precision but is easier to administer and typically errs on the side of longer retention, which reduces the risk of premature disposal.

Records Hold and Litigation Readiness

When an organisation becomes aware of actual or reasonably anticipated litigation, regulatory investigation, or similar proceedings, it must suspend its standard retention schedule for records relevant to those proceedings. This is commonly referred to as a "records hold" or "legal hold". Routine disposal of records covered by a legal hold is a serious risk — in some jurisdictions it can constitute spoliation of evidence.

A workable records hold process requires that:

Legal or compliance functions are alerted promptly when proceedings are anticipated
The scope of the hold (which record categories, which date range) is documented
The hold is communicated to those responsible for the affected records
The hold is lifted in writing once proceedings are concluded and retention can resume normally

Secure Disposal of Paper Records

When paper records reach the end of their retention period and are approved for disposal, the method of disposal must be appropriate to the sensitivity of the content. For records containing personal data or confidential business information, cross-cut or micro-cut shredding is the standard approach. Many organisations use contracted document destruction services that provide a certificate of destruction as evidence that disposal was carried out correctly.

The disposal itself should be recorded in the retention schedule register or a separate disposal register, including the date, the record categories destroyed, the method of destruction, and — where applicable — the name of the contractor. This record of disposal is itself a record that should be retained for a defined period.