Both large and small companies can be overwhelmed by the volume of records that they create both in paper and electronic formats. What does your company do with this mountain of paper and electronic records? How long should your company retain and archive such records when considering the myriad of complex federal record retention requirements, state-specific record retention requirements and other government agency standards? A blanket indefinite retention and storage policy related to all of your company’s paper and electronic records is impractical, costly and not the answer!

Instead, an effective record management and retention policy will help to answer the above practical questions because such a policy will define a company’s legal and compliance recordkeeping requirements. In addition, the policy should outline a system by which a litigation hold can override certain record retention requirements if the litigation hold requires a longer retention period, as well as when a company’s records may be destroyed following expiration of the applicable retention periods.

Scope and Application of a Company’s Record Management and Retention Policy

The scope of a company’s record management and retention policy should apply to all records of the company, regardless of the format that such records are created or stored. Each business unit and all of the company’s employees and officers should be required to adhere to the policy. The terms of the policy should be followed consistently and reevaluated on a periodic basis by management, the length of which should be identified for in the policy.

Retention Schedule in a Company’s Record Management and Retention Policy

There is no single law or regulation that establishes an identical record retention period with which a company must comply. Instead, the number of laws and regulations requiring a company to retain certain documents is increasing, along with the penalties a company may face for failing to follow best practices in their record retention management. As such, an effective record retention schedule should be included in a company’s policy that addresses each type or category of record created by a company in the course of its business and indicates the associated time period that these records are required to be retained.

Key Elements of a Record Management and Retention Policy

The policy should provide, at a minimum, the following:

• Types of records covered by the policy
• Specified procedures related to maintenance of each category of records created or obtained
• Record retention instructions, retention time periods and storage procedures
• Identification of all custodial personnel and business units that the policy applies to and responsibilities of each such personnel and business unit
• Timeframe for when the policy should be reviewed and evaluated
• Steps that a company will take to ensure compliance with the policy and specified consequences for violations

Record Destruction

Companies should also have a system in place in which they identify the types or categories of records that are subject to a specific retention period and/or subject to a litigation hold. This identification system will provide guidance to the company as to when these records may be destroyed once the requisite retention period has passed or the litigation hold has been lifted. The policy should also provide clear record disposal and destruction guidelines that the company and/or its third-party contractors will follow.

Litigation Holds

In addition to complying with the record retention requirements set forth in a record management and retention policy, a company may receive a litigation hold in anticipation of litigation. A litigation hold is a written instruction that requires a company to preserve certain documents that may serve as potentially relevant evidence in an anticipated litigation or governmental investigation. If a company receives a litigation hold, it will be immediately required to preserve all documents (regardless of the format in which such documents are stored) related to such anticipated litigation or investigation, and ensure that these documents are not deleted in accordance with the retention schedule in the policy. The policy should provide a plan that outlines the specific steps it must take to override certain record retention periods related to documents covered by the litigation hold if the litigation hold requires a longer retention period.

The Importance of Having a Record Management and Retention Policy and Next Steps for Your Company

The most important takeaway here for companies is that they have a written record management and retention policy, and that their employees, officers and applicable third parties are following this policy consistently and effectively. If your company does not have such a policy in place, it is prudent of you to engage proficient advisors to assist in creating a written record management and retention policy and putting appropriate protocols in place to ensure compliance with federal and state retention requirements.

Phillips Lytle is uniquely situated to provide legal advice and services in this area as its Data Security & Privacy Practice Team has ample experience in assisting both large and small companies with creating and updating their record management and retention policies, as well as creating systems by which companies can manage their types of records based on the applicable retention periods.