Keeping every document “just in case” may feel prudent. For an SMB, it is more likely to accumulate personal information, storage costs and data that can be useful to an attacker if an incident occurs.
The right question is not “how much storage do we have?” It is “why are we keeping this document, for how long, and what do we do when it is no longer needed?”
ISO 27001 and Bill 25 offer a useful framework for answering those questions. They do not provide a universal retention schedule that you can copy and paste. They ask you to choose justified periods, apply them and be able to prove it.
ISO 27001: rules, responsibilities and evidence
ISO 27001 does not set one retention period for invoices, résumés or technical logs. Clause 7.5 requires you to control documented information. Based on the risks you retain, two Annex A controls complete the schedule: A.5.33 for the protection of records, and A.8.10 for information deletion.
For an SMB, this means:
- identifying categories of documents and personal information;
- determining the purpose for keeping each one;
- setting a duration and a clear end trigger;
- assigning someone to perform the purge;
- retaining evidence that the rule was followed.
A spreadsheet can be enough to start, provided it reflects your real systems: email inboxes, accounting software, shared drives, HR tools, CRM, backups and cloud providers.
Bill 25: destroy or anonymize information when its purpose is met
Quebec’s Act respecting the protection of personal information in the private sector requires an organization to destroy personal information once the purposes for which it was collected or used have been fulfilled, subject to a retention period required by law. It may also anonymize the information for serious and legitimate purposes, subject to the applicable conditions. Masking a name is not anonymization.
Your governance policies and practices must cover the retention and destruction of personal information. The relevant reference is section 3.3 of Act P-39.1. Section 3.1 identifies the person exercising the highest authority within the enterprise as the person responsible for the protection of personal information, unless that responsibility is delegated in writing.
That person should be involved in decisions affecting personal information. The Act does not require their formal approval of every retention schedule. What matters is having a documented practice that is applied and understandable.
Two questions for every document category
Before setting a retention period, always ask two questions:
- What legal, regulatory, contractual or operational obligation still justifies keeping it? Control A.5.31 is where you list them.
- What risk does keeping it create if the document is no longer needed?
The first question prevents premature destruction. The second prevents keeping material out of habit. Review the answer when a law, contract, dispute or system changes.
Four practical SMB examples
Invoices and accounting records
Invoices, receipts, statements and supporting records are kept to meet tax obligations and support financial statements. The starting point is six years from the end of the tax year the record relates to, not from the date printed on the invoice.
Do not limit the rule to your accounting system. Email copies, scans and exports kept in shared storage should follow the same logic.
Email is not a retention category by itself. It may be an invoice, a contract decision, an application, a complaint or a routine conversation with no lasting use.
Avoid a rule such as “keep all email for seven years.” File emails that form part of a business record, then periodically delete temporary messages, duplicates and unnecessary attachments.
Résumés from unsuccessful applicants
A résumé generally contains personal information. When someone asks me how long to keep it if the person is not hired, I suggest 12 months. After that, destroy it. If you want to keep it in a candidate pool, get clear consent.
Former employee files
HR files may need to be retained for payroll, tax, employment standards, benefits or litigation. That does not mean they should remain accessible indefinitely in an active folder.
Separate records by purpose and limit access to people who need it. Payroll and tax records often follow a longer period than the rest of the file.
The periods I suggest
The table separates periods set by an obligation from the periods I suggest.
| Category | Period | Rationale to document | Action at expiry |
|---|---|---|---|
| Invoices and accounting records | 6 years after the end of the tax year | Tax, accounting, contract | Securely destroy, unless an obligation or dispute applies |
| Client files (quotes, orders, deliverables and project correspondence) | My suggestion: 3 years after the engagement ends | Evidence of performance, warranty, claim and civil limitation period | Remove information that is no longer needed; retain tax records separately for the applicable period |
| Client and supplier contracts | My suggestion: 3 years after the contract ends | Contractual obligations, claim and civil limitation period | Retain the signed version and necessary amendments, then securely destroy |
| Client complaints and service requests | My suggestion: 3 years after closure | Service follow-up, quality, warranty and claim | Destroy notes and attachments that are no longer needed |
| Access, correction and privacy complaint requests | My suggestion: 3 years after closure | Evidence of processing, decision and limitation period | Restrict access, then securely destroy |
| Business email | Based on the record the message belongs to | Contract, decision, operational evidence | File with the record or delete |
| Unsuccessful applicant résumés | My suggestion: 12 months | Recruitment and consent | Destroy or renew consent |
| Former employee files | Based on the applicable obligation | Payroll, tax, employment standards, litigation | Restrict access, then securely destroy |
| Confidentiality incident register | At least 5 years from becoming aware of the incident | Regulatory requirement | Retain with restricted access, then securely destroy |
| Event logs | Based on the security need | Incident detection, investigation, compliance | Purge under the rule |
Three years is my suggestion for records kept mainly to answer a civil claim in Quebec. A law, a contract or an ongoing dispute can require longer. When that happens, the longer period wins.
The confidentiality incident register is not a suggestion: the minimum period is five years. I explain how to prepare it in Confidentiality incident: the plan before the incident.
For logs, the period depends on what you still need to be able to investigate. I set out the reasoning in How long can I keep my system event logs? and the link with personal information in Event logs, Bill 25 and privacy.
What an auditor will want to see
An ISO 27001 auditor will not be looking only for a well-presented table. They will want to know whether your retention schedule actually works.
Prepare simple evidence:
- a person responsible for each process;
- a schedule approved by management or incorporated into your internal policies;
- the locations where documents exist, including backups and SaaS tools;
- a purge or secure-destruction method;
- deletion records, tickets, logs or purge reports;
- a documented exception for an audit, dispute or retention obligation.
Destruction must account for copies as well. Deleting a file from a shared drive without considering backups, email archives and third-party tools leaves the rule incomplete. An immutable backup keeps the document until the end of its cycle: that cycle is part of the period. With a vendor, destruction is settled before you sign. It is one of the points in a PIA.
Start small
In short, five categories are enough to start: invoices, contracts, employee files, résumés and email. For each, record the purpose, duration, system, owner and action at expiry. Run a real purge and keep the evidence.
Does your schedule account for backups, or only for the file you can see on screen?