Your company’s records may be spread across email accounts, shared drives, accounting software, and employees’ phones. Keeping everything creates cost and privacy risks; deleting too quickly can erase records you need for taxes, employment matters, or a dispute. A practical document retention policy gives California businesses a consistent way to decide what to keep, where to keep it, and when deletion is appropriate. Here is how to build one your team can actually follow.
A document retention policy small business teams can follow
Start with the records your business actually creates, not a lengthy template designed for a different industry. Your policy should cover paper and electronic records, including email, text messages, collaboration platforms, and documents stored with outside service providers.
Organize records by business purpose. A short retention schedule is easier to use than a rule for every file type. For each category, identify:
- The responsible person: Who maintains the official record and approves deletion?
- The storage location: Where should employees save the authoritative copy?
- The retention period: How long must the record remain available?
- The starting event: Does the period begin at creation, contract expiration, termination of employment, or another event?
- The disposal method: How will paper and electronic copies be securely removed?
Assign one policy owner, even if different departments maintain different records. For a small company, that may be an operations manager working with accounting and legal advisers. Itkin Law’s outside general counsel services can help connect these operational decisions with legal requirements.
Set retention periods by record category
There is no single California retention period that applies to every business document. Applicable rules depend on the record, the employer, the industry, and sometimes the company’s contracts. Separate mandatory minimums from longer periods adopted for a documented business reason.
- Payroll records: California Labor Code § 1174(d) requires specified payroll records to be kept for at least three years. Other employment recordkeeping requirements may require longer retention.
- Personnel and applicant records: California Government Code § 12946 generally requires employers, labor organizations, and employment agencies subject to the FEHA to maintain and preserve applications, personnel, membership, and employment-referral records and files for at least four years after creation or receipt, and personnel files of applicants or terminated employees for at least four years after the employment action. Upon notice that a verified FEHA complaint has been filed, covered entities must preserve relevant records until the later of the applicable civil-action filing period or final disposition of the complaint and all related administrative, civil, appellate, and other proceedings.
- Contracts: Keep executed agreements, amendments, relevant communications, and performance records together. California Code of Civil Procedure § 337 generally provides a four-year limitations period for actions on written contracts, but that is not itself a document retention rule.
- Tax and accounting records: Ask your tax adviser to identify the periods applicable to your filings, supporting documents, assets, and any open examination. A generic schedule may miss exceptions.
- Ownership and governance records: Identify records needed throughout the company’s life, such as formation documents, ownership records, and significant approvals.
Do not count a contract’s retention period solely from its signing date. Obligations may continue for years, and a claim’s filing deadline may depend on when it accrues, tolling, or another legal rule. Build the schedule around those circumstances rather than simply copying a limitations period.
Make saving and deletion routine
A policy works only if employees can follow it during ordinary work. Choose designated repositories, simple naming conventions, and clear instructions for moving business communications into the appropriate record system. Avoid making one employee’s inbox the only source of an important agreement.
Use a repeatable process:
- Inventory your systems, including archived accounts, mobile devices, and vendor platforms.
- Separate official records from duplicates and temporary working copies.
- Configure retention settings to match the approved schedule.
- Review records eligible for deletion on a regular calendar.
- Record the categories deleted, the date, and the approving person.
Test whether records can be retrieved before relying on an archive. Backups support recovery, but they do not necessarily provide a searchable archive. Document how backup rotation works and what happens when an employee leaves or a vendor relationship ends.
Pause deletion when a dispute becomes foreseeable
A routine retention schedule does not authorize destruction of relevant evidence when litigation is pending or reasonably anticipated. A specific demand letter, threatened lawsuit, or other developing dispute may require prompt preservation. Relevant records may include texts, attachments, drafts, and metadata—not just signed documents.
Ask counsel to assess whether a preservation notice, often called a litigation hold, is needed. The notice should identify relevant subjects, custodians, and systems. Suspend automatic deletion where necessary, tell affected employees what to preserve, and address records held by vendors or departing personnel.
Preservation is not simply an instruction to keep “important files.” Confirm that the relevant systems are protected and revisit the hold as the matter develops. Obtain legal approval before releasing it and restarting routine deletion.
Balance preservation with privacy and security
Keeping sensitive information indefinitely is not a substitute for compliance. Limit access to personnel files, financial information, and customer data. Use secure disposal methods appropriate to the information and storage medium.
For a business subject to the California Consumer Privacy Act that controls the collection of a consumer’s personal information, Civil Code § 1798.100(a)(3) requires, at or before the point of collection, disclosure of the intended retention period for each category of personal information, including sensitive personal information, or the criteria used to determine it. The business may not retain that information for a disclosed purpose longer than is reasonably necessary for that purpose. Not every small business is covered, so assess applicability rather than assuming it.
Review the policy annually and after major changes in staffing, services, software, or legal obligations. Train employees on a few concrete examples so they know where records belong and when to ask before deleting.
Talk to a California business attorney
A free consultation with Itkin Law can help you identify the legal questions behind your company’s retention schedule and preservation procedures. Schedule a free consultation or call (424) 603-8888.
This article is attorney advertising and provides general information only. It is not legal advice and does not create an attorney–client relationship. The law changes, and this article reflects the law as of its publication date. Every situation is different — contact us to discuss how the law applies to your exact circumstances. See our full disclaimer.
