Every file you hold is a file that can be exposed, and eleven versions of a document means nobody knows which is current. Here is the schedule that fixes both without deleting something you needed.
Most small businesses have no retention policy, which is itself a policy: keep everything forever. It feels safe and it is not.
Why keeping everything is a risk
Every file you hold is a file that can be exposed. Verizon 2025 Data Breach Investigations Report, drawn from 22,052 real incidents and 12,195 confirmed breaches across 139 countries, found stolen credentials the most common entry point at 22 percent, and 88 percent of small and medium business breaches involving ransomware against 39 percent at large enterprises. Data you deleted five years ago cannot appear in any of those incidents.
There is also a practical cost that shows up daily rather than rarely: when eleven versions of a document exist, nobody knows which one is current, and somebody eventually sends the wrong one to a client.
Deleting on a schedule is defensible. Deleting on instinct is not, and neither is keeping everything because nobody decided.
How to build it
1. Write the schedule before automating anything
Categories, retention periods, and an owner for each. Client deliverables, contracts, financial records, employee records, marketing assets, internal working files. Six categories is usually enough and twenty is unmanageable.
2. Take advice on the periods, and record where they came from
Retention requirements differ by jurisdiction, industry and contract, and I am not qualified to tell you what yours are. Your accountant will know the financial ones and your contracts will specify some client ones. Write the source next to each period so the schedule can be defended later.
3. Never delete in one step
Archive first, delete after a further period. The archive stage gives you a window where a mistake is recoverable and surfaces anything still in use before it disappears. This single design choice is what makes automated deletion safe enough to run.
4. Notify the owner before each stage
A list of what is about to be archived or deleted, with a simple way to extend. Silence proceeds, which is the correct default here, but the notification is what prevents the one bad surprise.
5. Handle legal holds explicitly
If anything is subject to a dispute, an audit or a live claim, it must be excluded from the schedule entirely. Build a hold flag before you build deletion, not after, because deleting something under dispute is a genuinely serious problem.
6. Log every action
What was archived or deleted, when, under which rule. This log is the entire point if anyone ever asks how you handle data, and it costs nothing to keep.
Tools and what they cost
| Option | What it costs | Honest trade-off |
|---|---|---|
| Google Workspace or Microsoft 365 retention policies | Included in business tiers. | Native, well tested, and applies across mail and files. Configuration is genuinely fiddly and easy to get wrong on the first attempt. |
| Apps Script over Drive folders | Free with Google Workspace. | Full control of category rules and the archive stage. You must build the safety features, especially holds, yourself. |
| Document management systems | Per user monthly. | Retention built into the filing structure, which is the cleanest approach. A migration and a habit change for the whole team. |
| A quarterly manual review against a written schedule | Free. | Perfectly acceptable for a small business and better than most manage. It depends on somebody doing it, which is what automation removes. |
What it is actually worth
Three things, and the first is the one people underestimate.
Reduced exposure. Data you no longer hold cannot be stolen, and the categories with the longest retention are usually the most sensitive.
Findability. Fewer files means the current version is the one people find. This is a daily benefit rather than an insurance one.
Defensibility. Being able to state your retention policy, show the schedule and produce the log is what a client security questionnaire, an insurer or an auditor is actually asking for. Increasingly, larger clients ask.
Your own starting number: count how many files older than five years you currently hold, and how many contain client or personal data. That is your current exposure and most businesses have never looked.
How it breaks
Something under legal hold gets deleted. The most serious possible failure. Build holds first.
The schedule is written and never applied. Extremely common, and arguably worse than having none, because you now have a documented policy you demonstrably do not follow.
Notifications go to people who have left. Owners need maintaining, and this is where a retention system quietly stops having anyone in charge.
Archived means invisible rather than retrievable. If nobody can find archived material, people start keeping private copies, and you have made the exposure worse rather than better.
How to tell whether it worked
Data older than its retention period still held, target zero. The share of categories with a named owner and a defined period, target all. And successful retrievals from the archive, which proves archiving is real rather than a synonym for losing things.