Data Retention Schedule Generator

About the Data Retention Schedule Generator

A retention schedule says, for each kind of record, how long it is kept, from when, why, how it is disposed of and who is responsible. Data protection law asks for one — personal data is kept no longer than its purpose needs (GDPR Article 5(1)(e); in India, section 8(7) of the DPDP Act) — and company, tax and employment law set minimum periods for many records.

Choose the country the presets come from — India, the UK, the US, the EU or another — and tick the records you keep: accounts and tax records, invoices, payroll, employee files, customer accounts, contracts, marketing consents, support tickets, CCTV footage and server logs, plus any of your own. Each preset gives the period, the event that starts it, the reason and the provision it comes from, such as the Companies Act, 2013, section 128(5), the CGST Act, section 36, the DPDP Rules, HMRC’s record-keeping guidance or the IRS; change any period, and it is marked as your own choice, as is every period with no legal source. The free preview shows the policy as marked page images and the first rows of the schedule; the policy as DOCX and PDF and the schedule as XLSX need a Premium pass.

Common uses

• Writing the retention policy a data protection audit, a customer’s security questionnaire or an ISO 27001 project asks for.
• Answering “how long do you keep my data?” in a privacy notice, with the same periods everywhere.
• Clearing out old files, mailboxes and backups with a documented reason for what goes and what stays.
• Giving finance, HR, IT and customer service one table of who keeps what, and for how long.

Where the preset periods come from

• India: books of account and their vouchers, for the eight financial years before the current one (Companies Act, 2013, s.128(5)); a GST-registered business’s accounts and records, until 72 months after the due date of the annual return, and one year after an appeal or investigation ends if that is later (CGST Act, 2017, s.36); personal data, erased when consent is withdrawn or the purpose is no longer served (DPDP Act, 2023, s.8(7)); logs and personal data of processing, one year (DPDP Rules, r.6(1)(e) and r.8(3), from 13 May 2027); large e-commerce, gaming and social media platforms, three years after the user’s last activity, with 48 hours’ notice (r.8 and the Third Schedule); logs of ICT systems, a rolling 180 days in India (CERT-In Directions under s.70B(6) of the IT Act, direction (iv)).
• United Kingdom: company and accounting records, 6 years from the end of the last company financial year they relate to; VAT records, at least 6 years (10 for OSS and MOSS); PAYE records, 3 years from the end of the tax year (HMRC on GOV.UK); claims under a contract, 6 years, and under a deed, 12 (Limitation Act 1980, ss.5 and 8, England and Wales).
• United States: tax records, 3 years in most cases, 6 if income was under-reported by more than 25%, 7 for worthless securities or bad debts, and employment tax records at least 4 years (IRS); payroll records 3 years and time cards 2 years under the Fair Labor Standards Act (29 CFR Part 516); personnel records, 1 year (29 CFR 1602.14).
• EU and EEA, and other countries: accounting, tax and employment periods are national, so their presets are marked “our own choice” for you to replace; CCTV follows the EDPB’s guidance that footage is in most cases erased after a few days.

Set by law, a legal time limit, or your own choice

Every row of the schedule says where its period comes from. Set by law means a provision or official guidance gives the period; it is a minimum, and your period may be longer — except where the law sets the latest point of erasure, as the DPDP Rules do for the accounts of large platforms’ inactive users, where your period may be shorter but not longer. Follows a legal time limit means the period matches the time within which claims can be brought, such as six years for a contract claim in England and Wales. Our own choice means no legal source: the period is your decision, and the policy says so. A period you type in place of a preset is marked as your own choice, with the preset beside it.

What the policy says

The policy sets its purpose with the storage principle of your law, its scope (paper, electronic records and backups, including those held by service providers), the roles — policy owner, record owners and the approver of disposals — the schedule, legal holds that stop disposal during a claim, an investigation or an audit, the methods of disposal and the disposal log, how erasure requests and exceptions are handled, and the review interval. It ends with the sources of the periods and a line for its approval.

Limitations

• The presets cover the common records of a business, not every law: sector rules (banking, insurance, health, telecoms, regulated professions), state and local rules, tax audits and your contracts can require longer periods.
• Limitation Act periods are those of England and Wales; Scotland and Northern Ireland have their own. Presets for the EU and other countries leave the accounting, tax and employment periods to your country’s law.
• The DPDP Rules’ erasure and log rules apply from 13 May 2027.
• The schedule is only as good as its use: records still have to be found and disposed of in every system and backup. Not legal advice.

Privacy

Everything is worked out in your browser; nothing you enter is uploaded. A draft is kept in this browser only if you tick “Keep a draft in this browser”.