Records are kept largely because the law, regulators or contracts require it - and increasingly because privacy law requires you not to keep them too long. A records manager must translate a patchwork of obligations into a single, workable set of rules. The specific statutes differ by country; the categories below apply across virtually every market.

The main families of obligation

  • Sector and financial law - tax, company, banking, health, occupational-safety and industry-specific rules that set minimum retention periods.
  • Privacy and data protection - the EU GDPR, the UK GDPR, POPIA (South Africa), the CCPA/CPRA (California), the PIPL (China) and many others. These impose storage limitation (don't keep personal data longer than necessary), lawful basis, data-subject rights and breach reporting.
  • Access-to-information / freedom-of-information - public bodies (and sometimes private ones) must be able to find and produce records on request.
  • Evidence and litigation - rules of evidence and legal hold: once litigation is reasonably anticipated, relevant records must be preserved even if their retention period expires.
  • National-archives and public-records law - for government bodies, the transfer of archival records to a national or state archive is mandatory.

The tension you must manage

Retention law says "keep it long enough". Privacy law says "don't keep it too long". The records manager resolves this by setting a defensible period for each record type - the longest applicable minimum - and then disposing of the record when that period ends, unless a legal hold applies.

Legal hold beats the schedule. A retention schedule may say "destroy after 7 years", but if the record is relevant to actual or anticipated litigation, an audit, or an investigation, destruction must stop immediately. Automated disposal must always check for holds first.

Working across jurisdictions

Multinational organisations face overlapping and sometimes conflicting rules. The usual approach is a global retention schedule with country-specific overrides, and data-residency rules that keep certain records in-region. Never assume one country's periods apply everywhere.

Key takeaways

  • Retention law sets minimums; privacy law sets maximums - your schedule lives between them.
  • Legal hold always overrides scheduled disposal.
  • Global organisations need a base schedule plus jurisdiction overrides and data-residency rules.

Check your understanding

Last modified: Saturday, 1 August 2026, 10:06 AM