Generally, the rule of thumb is to keep records for at least six years. This includes records of all your income, expenses, and any other transactions related to your business.
A retention period (associated with a retention schedule or retention program) is an aspect of records and information management (RIM) and the records life cycle that identifies the duration of time for which the information should be maintained or "retained", irrespective of format (paper, electronic, or other).
CPRA requires you to retain the data for no longer than necessary. It states that your retention “shall be reasonably necessary and proportionate to achieve the purposes” for which it was collected, processed, or for another disclosed purpose.
Six Key Steps to Developing a Record Retention Policy STEP 1: Identify Types of Records & Media. STEP 2: Identify Business Needs for Records & Appropriate Retention Periods. STEP 3: Addressing Creation, Distribution, Storage & Retrieval of Documents. STEP 4: Destruction of Documents. STEP 5: Documentation & Implementation.
Record Retention Schedule for Businesses DocumentRetention Period Contracts and leases (expired) 7 years Correspondence, general 2 years Correspondence, legal and tax related Permanently Deeds, mortgages and bills of sale Permanently36 more rows
ISO 27001 Data Retention Requirements – 3 years The ISO 27001 compliance framework requires organizations to retain data logs for at least three years.
Records Retention 2.0 For example, any financial records must be kept for seven years after they are created or received and should be stored securely. And all business tax records must be kept for five years after the filing due date.
The new law, the California Privacy Rights Act (CPRA), which goes into effect Jan. 1, 2023, goes further. It requires companies to disclose how long they keep each category of personal information or, if that's not possible, the criteria they use to determine retention periods.