Document Retention and Destruction Policy

Organization: [ORG]
Adopted by the Board of Directors: [DATE]
Last reviewed: [REVIEW_DATE]
Policy owner: [BOARD SECRETARY / GENERAL COUNSEL / COMPLIANCE]
Applies to: Directors, officers, employees, and contractors who create or hold [ORG] records

Template notice. Retention periods must be aligned with tax, employment, securities, healthcare, nonprofit, and industry rules applicable to [ORG]. Counsel should validate the schedule in Appendix A before adoption. Replace bracketed placeholders.

---

1. Purpose

Records are institutional memory and legal evidence. This Policy ensures [ORG]:

1. Retains records long enough to meet legal, fiscal, audit, and operational needs;
2. Protects confidential and privileged information;
3. Suspends destruction under legal holds;
4. Disposes of records securely when retention expires; and
5. Gives the Board confidence that minutes, packs, decisions, and compliance files remain available for fiduciary review.

Indiscriminate “keep everything forever” and chaotic deletion are both risks. This Policy sets a disciplined middle path.

---

2. Scope — What Is a Record

“Records” include information created, received, or maintained in the course of [ORG] business, regardless of medium: paper, email, chat exports designated as records, board portal files, cloud drives, recordings (where retained), databases, and messaging tied to official decisions.

Examples relevant to the Board:

• Articles, bylaws, committee charters, policies;
• Board and committee agendas, packs, presentations, and minutes;
• Written consents, resolutions, and action-item logs;
• Conflict questionnaires, related-party approvals, whistleblower investigation files;
• Contracts, financing documents, insurance policies;
• Financial statements, audit reports, tax filings;
• Director onboarding and independence materials.

Personal notes that are not shared and not used as the official record may fall outside retention — but if they become the de facto record of a decision, treat them as records. Prefer official minutes in the portal over side channels.

---

3. Roles and Responsibilities

Directors should use the official board portal for packs and annotations where provided, and avoid retaining stale local copies beyond need.

---

4. Retention Principles

1. Official copy. Identify a system of record (typically the board portal for Board materials; ERP/finance systems for books; HRIS for personnel). Duplicates may be destroyed earlier if the official copy is retained.
2. Minimum periods. Appendix A sets minimum retention. Longer retention is allowed when business need exists; shorter retention requires counsel approval.
3. Privacy minimization. Do not retain personal data longer than needed once the retention period and any hold expire.
4. Consistency. Apply rules by record category, not by convenience.
5. Transitory records. Drafts superseded by finals, scheduling emails, and pure logistics messages may be discarded when no longer useful, unless subject to a hold.

---

5. Board and Committee Materials

Unless Appendix A or counsel specifies longer:

• Minutes and resolutions: permanent (or [PERMANENT / X years after dissolution]).
• Agendas and board packs: at least [7] years after the meeting date, or longer if they support open audit, litigation, or regulatory matters.
• Audio/video recordings of meetings: [90 DAYS / UNTIL MINUTES APPROVED], then destroy unless hold or Board votes to retain a specific recording. Recordings are not a substitute for minutes.
• Director annotations in the portal: retained per portal settings aligned to pack retention, subject to hold.
• Executive session minutes/notes: retained per Executive Session Policy; access restricted.

The Secretary shall ensure approved minutes are uploaded promptly and versioned so the approved copy is obvious.

---

6. Legal Holds (Litigation / Investigation / Audit)

When [GENERAL COUNSEL / COMPLIANCE] issues a legal hold:

1. Destruction and alteration of potentially relevant records stop immediately, notwithstanding Appendix A;
2. Affected custodians (including directors if named) receive written hold notice describing scope;
3. IT suspends auto-deletion where feasible;
4. Holds remain until counsel issues a written release;
5. Willful violation may result in discipline and legal consequences for [ORG] and individuals.

Directors who receive a hold must preserve portal content, email, and files in personal repositories that contain [ORG] materials related to the matter, and coordinate with counsel rather than selectively deleting.

---

7. Email, Chat, and Informal Channels

[ORG] email is a record system when it documents decisions, approvals, or compliance matters. Employees and officers should move substantive Board-related approvals into the portal or official minute process rather than relying on email chains.

Chat and SMS used for official decisions should be exported or summarized into the official record. Directors should avoid conducting Board business solely on personal messaging apps; if unavoidable, preserve and transmit to the Secretary.

---

8. Confidentiality and Security

Records containing personal data, health information, attorney-client privilege, competitive strategy, or whistleblower files require access controls commensurate with sensitivity. Storage must meet [ORG] security standards (encryption in transit/at rest as applicable, MFA for portal access, vendor diligence for board portal providers).

Privileged materials marked as such should not be forwarded broadly among directors without counsel guidance.

---

9. Destruction Procedures

When retention expires and no hold applies:

1. Identify records eligible for destruction via periodic review (at least [ANNUALLY]);
2. Obtain sign-off from [POLICY OWNER] for Board-category destructions;
3. Destroy paper via secure shredding; destroy electronic media via industry-standard wipe or cryptographic erasure;
4. Log category, date range, destruction date, and responsible party;
5. Confirm cloud vendor deletion per contract (including backups within vendor retention).

Do not destroy records that are responsive to pending public-records requests, audits, or member inspection rights where applicable to [ORG].

---

10. Departing Directors and Employees

Upon departure, directors must return or certify destruction of local copies of [ORG] confidential materials per the Board Confidentiality Agreement, while official portal records remain with [ORG]. Accounts are revoked on a schedule set by IT and the Secretary. Archival access for former directors is not routine and requires Board/counsel approval.

---

11. Noncompliance

Failure to follow retention or hold obligations may result in disciplinary action and can create severe legal exposure (spoliation sanctions, regulatory findings). Report suspected violations to [COMPLIANCE / GENERAL COUNSEL] or via the Whistleblower Policy channels.

---

12. Review Cycle

The Policy owner shall review Appendix A at least annually with counsel and propose updates to the [AUDIT / GOVERNANCE] Committee. Board approval required for material changes. Next review: [NEXT_REVIEW_DATE].

---

Appendix A — Retention Schedule (starter; counsel to finalize)

---

Appendix B — Legal hold intake checklist

• Matter name / counsel contact
• Date hold issued / custodians notified
• Systems in scope (portal, email, shared drives, devices)
• Keywords / date ranges
• Backup and auto-delete suspensions confirmed
• Release date and confirmation logged