Most organizations keep data far longer than they need to, not because anyone decided to, but because nobody decided not to. Deletion feels risky and keeping feels free, so inboxes, file shares, backups, and old databases grow quietly for years. Then a regulator asks a question, a legal matter demands discovery, or an incident exposes records the business forgot it held, and leaders discover that keeping everything was a decision after all, one made by default and owned by no one. My view is simple: retention is a business decision with legal and risk consequences, and it should be made deliberately, by leadership, in language leadership can act on.
Keeping data is not the safe option
The instinct to keep everything usually comes from caution, yet it cuts both ways. Data you hold can be breached, subpoenaed, misused, or produced in disputes, including data that should have been deleted years earlier under any reasonable schedule. Data you hold also has to be protected, and protection has a cost in systems, access management, and attention. None of this means delete aggressively and hope for the best. Some records must be kept for defined periods under law, regulation, contract, or tax rules, and deleting those early creates its own serious problems. The governance failure is not keeping data or deleting it. The failure is having no schedule that says which is which, and no one accountable for the answer.
Frame the decision in leadership language
Retention proposals often stall because they are presented as housekeeping or as an IT storage question. Leaders do not act on housekeeping. They act on obligations and exposure. The case that works sounds like this: here are the categories of data we hold; here is what the law, our regulators, and our contracts require us to keep, and for how long; here is what we keep beyond any requirement, and the risk and cost of doing so; and here is the schedule we recommend, with owners. Presented that way, retention becomes a set of business judgments leaders are equipped to make, and the resulting schedule carries their authority instead of being one department's preference.
A schedule only counts if it runs
Adopting a retention schedule is the midpoint, not the finish. The schedule has to connect to how data actually lives: email, shared drives, line of business systems, archives, and backups, each of which behaves differently. Someone must own execution, legal holds must override deletion cleanly when litigation or investigation requires it, and exceptions should be approved, time limited, and recorded rather than granted informally forever. A light annual review keeps the schedule honest as laws, contracts, and systems change. Without that operating discipline, the policy becomes wall decoration, and the organization drifts back to keeping everything by default.
Start where the risk concentrates
A full retention program can look daunting, which tempts organizations to postpone it entirely. Start instead with the categories that carry the most sensitivity and the least business need: records involving customers, employees, health or financial information, and the archives of departed staff and retired systems. Agree the schedule for those first, prove the process works, then extend it. Progress on the highest risk data is worth far more than a perfect plan that never leaves the drawer.
The takeaway
Ask leadership one question: for each major category of data we hold, can we say how long we keep it, why, and who decided? If the answer is silence, you do not have a retention position, you have an accumulation habit. Making the decision deliberately is the whole control.