Records management and retention schedules
A retention schedule says, for each class of record you hold, how long it is kept, why, and what happens at the end. We build the schedule, the file plan it hangs from, and the records system configuration that enforces it, so you keep what the law and the business require and dispose of the rest on the record.
What a retention schedule and file plan cover
The file plan, or classification plan, is the structure: functions, activities and the record classes under them. The schedule attaches a period, a trigger and a final action to each class. “Seven years after the contract ends, then destroy” is a schedule line. “Keep finance records” is not.
Every period carries its source. Some come from statute, some from limitation periods, some from contracts or funders, and some are a business choice that is written down as one. Under BC PIPA and FIPPA, personal information used to make a decision about someone has a one-year floor. That is a minimum, not a default.
The detail of how schedules are built is in records retention schedules, explained.
Why keeping everything is the risky option
Over-retention feels safe and is not. Every file share of old HR exports and every mailbox kept “just in case” is data an intruder can take and a breach notice has to count. The records you should have destroyed five years ago widen the blast radius of an incident today.
Privacy law points the same way. BC PIPA expects personal information to be destroyed or de-identified once its purpose is served and retention is no longer needed. A schedule is how you show that happens on purpose. It sits naturally beside Canadian privacy readiness.
Content Manager and SharePoint records management
A schedule on paper changes nothing until the system enforces it. For OpenText Content Manager we map classes to record types and retention schedules. For SharePoint and Microsoft 365 we map them to Purview retention labels, a file plan and, where the volume justifies it, auto-apply policies.
We test disposition in a pilot area first. Deleting the wrong series at scale is the one mistake a records project cannot undo.
Defensible disposition, legal holds and FOI
Disposition is defensible when it follows an approved schedule, is applied consistently, and leaves a record: what was destroyed, under which rule, approved by whom. That record is what you show a court or a commissioner.
A legal hold overrides all of it. When litigation or an investigation is underway or reasonably expected, disposition stops for the affected records. After a breach this matters twice over, as covered in preserving evidence after a breach.
For BC public bodies, findability is its own obligation. An access request under FIPPA reaches every responsive record you hold, including the ones nobody can locate. A working file plan is what makes the search finish. Related public-sector work is on FIPPA privacy impact assessments and information-sharing agreements.
What you receive
| Deliverable | What it is for |
|---|---|
| File classification plan | One structure staff and the system both file against |
| Retention schedule | Period, trigger, final action and source for every class |
| Legal hold and disposition procedure | Who applies a hold, who approves destruction, and what gets logged |
| System configuration | Content Manager or SharePoint and Purview set up to enforce the schedule, tested in a pilot |
How the work is bounded
The scope is agreed in writing before work starts, and the engagement is quoted in writing with it.
SecHB does not issue certifications, attestations or audit opinions: those come from accredited certification bodies, CPA firms and QSAs. The work here is what an organization does to be ready for them.
Nothing here is legal advice. Where a question turns on the law, the work is done alongside the client’s counsel, not instead of them.
Questions we are asked
How long should we keep records?
There is no single number. Each class of record takes its period from the law that governs it, a limitation period, a contract or a business need, and the longest of those usually sets the period.
Do you give legal advice on retention periods?
No. We are not lawyers; we work alongside your counsel. We research and draft each period with its source, and counsel confirms the ones that rest on a legal reading before the schedule is approved.
Can you configure Content Manager or SharePoint to enforce the schedule?
Yes. The schedule is mapped to Content Manager record types and retention schedules, or to Microsoft Purview retention labels and file plans for SharePoint and Microsoft 365, and disposition and holds are tested before anything is deleted for real.
What happens to records under a legal hold?
They come out of disposition until the hold is lifted, whatever the schedule says. The hold is applied in the records system rather than by memo, and releasing it is a recorded decision.
Start with the records you hold today
Tell us roughly what you hold, where it lives and what prompted the question: an access request, an incident, a system migration or a regulator’s question. The reply says what a schedule would cover. See also all compliance and privacy work.