Records, Retention, Legal Holds and Workplace Privacy

Lessons 03 and 13 call data minimization the cheapest control a business owns, and lesson 10 lists a retention policy among the eight. None of them says how to build the schedule, which law sets the minimum for which record, or what happens to the schedule the day a demand letter arrives. This lesson fills that gap. It also pulls employee monitoring into one place, because it showed up in lesson 06 as a federal wiretap issue, in lesson 07 as a state notice issue and in lesson 10 as a policy issue, and a manager has to treat it as one decision.

One pull says keep more. Keep too little and you cannot prove a payroll calculation, defend a discrimination charge or show an auditor what happened. The other pull says keep less. Keep too much and every breach grows. Take Cedar Ridge Distribution, an invented firm with 140 employees. If it holds 9,000 old job applications with Social Security numbers and a breach hits that system, the notice list is 9,000 people longer than it needed to be. At the assumed $1.10 per first-class notice used in lesson 06, that is 9,000 x $1.10 = $9,900 in postage and printing alone, before credit monitoring or any other cost. The records had no business value after the 1-year EEOC clock ran out. The schedule exists to catch exactly that.

Building the retention schedule

A schedule is a table. Each row is a class of record, not a file. Each row needs five things: the minimum period and the rule that sets it, the business reason to keep it longer if you do, the owner, the disposal method, and the trigger date that starts the clock. The trigger matters most. Many rules count from an event, such as the end of employment or the last entry, not from the date a record was made.

Record class	Minimum period (as of October 2026)	Where it comes from	Clock starts
Employment tax records	At least 4 years	IRS guidance: 4 years after the date the tax becomes due or is paid, whichever is later	Due or payment date
Income tax return support	3 years by default; 6 years if you left out more than 25 percent of gross income; 7 years for a worthless-securities or bad-debt claim; no limit if no return was filed or the return was fraudulent	IRS "How long should I keep records?"	Filing date of the return
FLSA payroll records	3 years	29 CFR 516.5	Last date of entry
Time cards, wage rate tables, order and billing records	2 years	29 CFR 516.6	Last entry or last effective date
Personnel and employment records (applications, hiring, promotion, discharge, pay decisions)	1 year, and until final disposition once a charge of discrimination is filed	29 CFR 1602.14 (EEOC)	Date of the record or the personnel action, whichever is later
Age discrimination law payroll and personnel records	Payroll 3 years; personnel records 1 year; benefit plans for the life of the plan plus 1 year	29 CFR 1627.3	Date of record or action
Form I-9	The later of 3 years after hire or 1 year after employment ends	8 CFR 274a.2(b)(2)(i)(A)	Hire date and separation date
OSHA 300 log, 301 reports, annual summary	5 years following the end of the calendar year the records cover	29 CFR 1904.33	End of the calendar year
Employee medical and exposure records under OSHA	Medical records: duration of employment plus 30 years. Exposure records: at least 30 years	29 CFR 1910.1020(d)	End of employment or the record date
FMLA records	3 years; medical certifications kept in files separate from the personnel file	29 CFR 825.500	Per the regulation
Benefit plan reports and records (ERISA)	Not less than 6 years after the filing date	29 U.S.C. 1027	Filing date
HIPAA policies and required documentation	6 years from creation or the date last in effect, whichever is later	45 CFR 164.316(b)(2)(i)	Creation or last effective date
Children's personal information collected online	Only as long as reasonably necessary for the purpose collected; never indefinitely; written retention policy required	16 CFR 312.10	Purpose ends
Biometric identifiers (Illinois)	Destroy when the purpose is satisfied or within 3 years of the person's last interaction, whichever is first	740 ILCS 14/15(a)	Purpose ends or last interaction

Read the first column as a floor, not a target. Several of these rules also say the clock restarts or stretches. The EEOC rule keeps records alive until a charge is finally resolved. The I-9 rule runs from two different dates and takes the later. The OSHA exposure rule can outlast the employee by decades. A schedule that says "7 years for everything" is simple, and it deletes some records too soon and keeps most too long.

What the schedule does not cover

Contracts, customer records, business email, chat, system logs and marketing lists have no single federal minimum. Their periods come from three places: a contract term, a statute of limitations for claims you might need to defend, and your own business need. I did not verify Idaho's limitation periods for contract claims in this lesson, so treat any figure you pick for contracts as your own decision and write the reason in the "business need" column. Idaho Code 45-609, which this lesson's source notes pointed to, is titled "Withholding of wages." It limits what an employer may withhold and requires a statement of deductions each pay period. It does not set a retention period. I did not find an Idaho statute that sets a general payroll retention period for private employers in this pass, so that point is unverified. In practice the federal periods above are the controlling ones for most Idaho employers.

Public records are a separate matter. Idaho's Public Records Act defines a public record as a writing relating to the conduct or administration of the public's business that is prepared, owned, used or retained by a state agency, an independent public body corporate and politic, or a local agency (Idaho Code 74-101). A private firm is not one of those bodies. A company that sells to government should still check its contract, because a contract can require it to keep and hand over records, and the text of 74-101 does not say whether records a contractor holds for an agency are reached. Lesson 16 covers government contracts and Idaho public-sector vendors.

Legal holds

A legal hold is a written instruction to preserve. Its job is to override the schedule and the auto-delete settings for a defined set of records. Without one, a business that was acting routinely on a Monday can be accused of destroying evidence on Tuesday.

What the law says about losing electronic evidence

Federal Rule of Civil Procedure 37(e) governs electronically stored information (ESI) that "should have been preserved in the anticipation or conduct of litigation" and is lost because a party "failed to take reasonable steps to preserve it," when it "cannot be restored or replaced through additional discovery." The rule works in tiers. Under 37(e)(1), on a finding of prejudice to the other side, the court may order measures "no greater than necessary to cure the prejudice." Under 37(e)(2), only on a finding that the party "acted with the intent to deprive another party of the information's use in the litigation," the court may presume the lost information was unfavorable, instruct the jury that it may or must presume so, or dismiss the action or enter a default judgment.

For a manager, the rule comes down to a few practical points. It looks at reasonable steps, not perfection. A written hold, issued promptly, with deletion suspended, is the standard evidence of reasonable steps. The trigger is anticipation of litigation, which comes before a lawsuit is filed. And the harshest outcomes need intent, but the milder tier needs only prejudice and a failure to take reasonable steps. Cost shows up in the first tier as money, extra discovery and costly forensic recovery.

Rule 26 sets the other side of the picture. Discovery is limited to nonprivileged matter relevant to a claim or defense and "proportional to the needs of the case," weighing the issues at stake, the amount in controversy, the parties' access to information, their resources, the importance of the discovery and whether burden or expense outweighs likely benefit (26(b)(1)). A party need not provide ESI from sources it identifies as not reasonably accessible because of undue burden or cost (26(b)(2)(B)). And the parties' discovery plan must address issues about disclosure, discovery or preservation of ESI, including the form in which it will be produced (26(f)(3)(C)). So a business that knows where its data lives, and which of it is hard to reach, argues proportionality from a position of fact.

Idaho's state-court rule is different, and a business should not assume the federal text applies in state court. Idaho Rule of Civil Procedure 37(e), as published on the Idaho Supreme Court site, is titled "Failure to Provide Electronically Stored Information." It says that absent exceptional circumstances a court may not impose sanctions under the rules on a party for failing to provide ESI lost as a result of the routine, good-faith operation of an electronic information system. That is the older safe-harbor idea. It does not use the word "preserve," and it does not copy the two-tier structure of the federal rule. I did not research Idaho case law on spoliation, so how an Idaho court treats a business that kept its auto-delete running after a dispute was in sight is unverified here. The safe course is the same in both systems: a good-faith routine is easiest to defend when it stopped the day a dispute became foreseeable.

Federal criminal and investigative provisions sit beside the civil rule. 18 U.S.C. 1519 makes it a crime to knowingly alter, destroy, mutilate, conceal, cover up or falsify any record with the intent to impede, obstruct or influence a federal investigation or a matter within federal jurisdiction, with a maximum of 20 years in prison. And 18 U.S.C. 2703(f) requires a provider of wire or electronic communication services or remote computing services to preserve records and other evidence in its possession on a government request for 90 days, renewable for another 90. If your vendors are those providers, expect a request to reach them without you. Your own duty comes from the dispute or investigation.

Triggers, owners and steps

Trigger	Who decides	First move
Demand letter, threat to sue, filed complaint	Owner or CEO, with HR or finance as the records lead	Written hold the same day
EEOC or state agency charge of discrimination	HR lead	Hold on all relevant personnel records; the EEOC rule already keeps them until final disposition
Subpoena, civil investigative demand or regulator letter	Owner and the records lead	Hold, plus a request log with dates and what was sent
Audit notice (tax, wage and hour, payment card, customer audit)	Finance lead	Hold on the periods and systems named
Serious incident (injury, fraud, breach, harassment complaint)	Security lead and HR	Hold on logs, video and messages around the event
Employee leaves on bad terms with a credible claim risk	HR lead	Preserve the mailbox and device image before reassigning them

Sample hold notice (reference)

Field	Sample content
To / From / Date	Named custodians / records lead / date issued
Subject	Preserve records: Matter 2027-03 (do not delete)
What happened	One sentence, neutral: "The company received a letter on March 9, 2027 about overtime pay for 2025 and 2026."
What to keep	Email, chat, texts about business, time cards, schedules, dispatch logs, payroll files and notes, from January 1, 2025 to the present, in any form, wherever stored
What to do	Do not delete, edit, overwrite or move these records. Turn off any personal auto-delete on devices used for work. Keep working normally otherwise.
Questions	Records lead, name and phone. Do not discuss the matter with anyone outside the company.
Acknowledgment	Reply "Received and will comply" within 2 business days

Defensible deletion

Deletion is a business process with evidence, not a click. "Defensible" means you can show that the deletion followed a written schedule, ran on a regular cycle, skipped anything under a hold and left a record. That record is the answer to the later question, "Why was this gone?"

Live systems, backups and SaaS

Records live in more places than the one the schedule names. The same invoice can sit in the accounting system, an email attachment, a shared drive, a backup set, a vendor's portal and a former employee's laptop. The schedule applies to the record, not to one copy of it.

Location	Problem	Control
Email and chat	Users keep everything, or auto-delete runs without a hold	Set a retention policy by class, and use hold features for matters. Microsoft Purview documentation says that content on hold is preserved until the location is removed or the hold is deleted, and recommends retention policies and labels over holds for general long-term retention. Google Vault documentation says holds preserve data indefinitely. Both are vendor statements, read October 2026.
Backups	Deleted records survive in backup chains, past the schedule	Match backup rotation to the longest schedule that backup contains, or document the exception and what happens if a record must be erased. Immutable backups (lesson 12) are meant to resist deletion, so decide the retention period when you set them.
SaaS applications	Vendor soft-delete windows, archived copies, no bulk delete	Ask what "delete" does, how long copies remain, and whether you can export before closing the account
Laptops and phones	Local copies outside any schedule	Keep company data in managed systems, wipe on return, and sanitize before reuse or disposal
Vendors and processors	Your data held after the contract ends	Contract clause for return and certified destruction (lesson 09); log the certificate
Paper	Boxes with no labels	Label with class and destroy-after date; shred through a vendor that gives a certificate

For destroying media, the reference is NIST SP 800-88 Revision 2, Guidelines for Media Sanitization, published September 26, 2025, which replaced Revision 1 of December 17, 2014. It defines sanitization as making access to the target data on the media infeasible for a given level of effort, and asks organizations to set up a program with controls matched to how sensitive the information is. Revision 2 still organizes sanitization into three methods, clear, purge and destroy (section 3.1 of the PDF, read October 2026), and treats destruction as the choice where media cannot be reliably cleared or purged. Anything written against Revision 1 should be re-read against the new text before you set a standard.

The deletion log

Date	Record class	System or location	Rule or schedule line	Method	Approved by	Held records skipped
2027-04-02	Applications older than 1 year	Applicant tracking system	Line 4, 29 CFR 1602.14	System purge, 1,740 records	HR manager	0
2027-04-02	Dispatch video older than 90 days	Camera storage	Line 11, business need	Overwrite cycle	Operations director	2 clips under Matter 2027-03
2027-04-09	Retired laptop (asset 0412)	Stockroom	Media disposal procedure	Purge and certificate	IT lead	0

A log like that costs a few minutes per cycle and does the work of a story you would otherwise have to remember under pressure.

Handling subpoenas, records requests and rights requests

Requests that touch the schedule come in several kinds. A subpoena or a government demand is compulsory and has a deadline. A customer or employee rights request under a state privacy law asks you to find, give back or delete personal data. A contract audit asks for records you agreed to keep.

The conflict between a rights request and a hold is real. A person asks you to delete their data, and the same data is under a hold. Most state privacy laws let a business keep data needed to comply with a legal obligation or defend a legal claim, but the wording and the scope differ by state and I did not verify each statute for this lesson, so that is unverified. The practical rule is to answer within the statutory time, state that some data is retained for a legal reason, delete what is not covered by the hold and log the decision. Lesson 13 covers the rights-request process and clocks.

For a subpoena, a records-request log is the control: date received, who sent it, what it asks for, response due date, who gathered the records, what was produced and what was withheld and why. Keep the log with the hold file. Anything you produce is also a record you must be able to show you produced.

Employee monitoring and workplace privacy, in one framework

Lesson 06 covered the federal statutes, lesson 07 the state notice laws and lesson 10 the policy. This section puts the decision in one order and adds what changed.

Step 1: what is the tool, and is anything being intercepted?

Federal law is the starting point. 18 U.S.C. 2511(2)(d) lets a person who is not acting under color of law intercept a communication if the person is a party to it or one party has given prior consent, unless the purpose is a criminal or tortious act. Idaho Code 18-6702(2)(d) has the same one-party structure. Section 2511(2)(a)(i) separately lets a provider's staff intercept in the normal course of employment as a necessary incident to providing the service or protecting the provider's rights or property. The Stored Communications Act, covered in lesson 06, separately restricts reading stored messages in an account you are not authorized to access. One-party consent describes federal and Idaho law. It does not describe every state, so recording calls with a customer in another state needs the strictest rule among the people on the call.

Step 2: which state notice laws apply?

State	What it requires	Penalty or enforcement	Verification
New York, Civil Rights Law 52-c (second section of that number)	Employers with a place of business in the state that monitor phone, email or internet use must give prior written notice at hire, get a written or electronic acknowledgment and post the notice conspicuously. The notice must say communications or internet use may be subject to monitoring at any and all times and by any lawful means. Processes that manage volume, are not targeted at an individual and serve only system maintenance or protection are excepted.	Attorney General; civil penalties up to $500, $1,000 and $3,000 for a first, second and third or later offense	Statute text read
Delaware, 19 Del. C. 705	An employer may not monitor or intercept phone calls, email or internet use unless it gives an electronic notice at least once on each day the employee uses the employer's email or internet service, or gives a one-time written or electronic notice that the employee acknowledges. System-maintenance processes not targeted at an individual are excepted.	Civil penalty of $100 for each violation	Statute text read
Connecticut, C.G.S. 31-48d	Prior written notice to affected employees of the types of electronic monitoring that may occur, posted in a conspicuous place where employees can readily see it (the posting counts as the written notice). Exceptions apply where the employer has reasonable grounds to believe employees are violating the law, violating legal rights or creating a hostile work environment and the monitoring may produce evidence, and the section does not apply to criminal investigations. Connecticut Public Act 26-73 (Substitute SB 472), signed June 4, 2026 and effective October 1, 2026, repeals and replaces the section. The new notice must also name the specific premises locations where monitoring may occur and be posted at those locations (airports, and locations monitored on reasonable grounds of security and employee safety, are excused from the location rule). Each employee hired on or after October 1, 2026 gets a plain-language written statement before starting work. The act does not require an employee to sign an acknowledgment.	Labor Commissioner, after a hearing; civil penalties up to $500, $1,000 and $3,000 for a first, second and third or later offense, unchanged by the act	Department of Labor notice read (earlier text and penalties). Act text read on the General Assembly site (signing date, effective date, location and new-hire statement rules)
California	Workers and applicants have consumer privacy rights, so notices at collection, access and deletion extend to HR and monitoring data (lesson 07)	CPPA and Attorney General	Taken from lesson 07
Other states	Not reviewed in this pass	Not reviewed	Unverified

A business with staff in several states does not need five notices. It needs one notice written to the strictest of them: name the kinds of monitoring (email, web, telephone, cameras, device and location data), state that monitoring can happen at any time, say where cameras and sensors are, get an acknowledgment at hire and once a year, and post it where staff will see it. Track which states your employees work in, because a remote hire in New York or Delaware makes those laws yours.

Step 3: labor law limits on what you may say

The National Labor Relations Act protects many private-sector employees when they act together to discuss pay and working conditions. A monitoring rule or social-media rule that reads as a ban on that talk can be challenged. The standard for judging workplace rules has moved. The Board's 2023 decision in Stericycle, Inc., 372 NLRB No. 113, set a test under which a rule that could discourage protected activity is presumed unlawful unless the employer shows a legitimate, substantial interest that a narrower rule could not serve. A law-firm summary reports that the NLRB General Counsel issued a memorandum on August 26, 2026 asking the Board to overturn Stericycle and return to the earlier Boeing (2017) and LA Specialty Produce (2019) approach. I did not read the memorandum or any Board decision overturning Stericycle, so whether it has been overturned as of October 2026 is unverified. Check the Board's website for the current standard before you adopt a social-media or confidentiality rule. The safe drafting habit does not change with the standard: tie the rule to a stated business purpose, and say plainly that it does not limit employees' lawful discussion of wages and working conditions.

Step 4: choose the tool and set its retention

Tool	Main risk	Control	Suggested retention for the data
Email and chat archive	Personal messages mixed in with business messages	Notice, access limited to named roles, access log	Per the schedule class for the content; business email 3 to 7 years is a common choice but your own decision
Web filter and endpoint logs	Capturing personal webmail or banking	Exclude categories from content inspection; do not log credentials	90 to 365 days, longer for security investigations
Cameras (inside the premises)	Places with a reasonable expectation of privacy; audio	Do not place in restrooms or changing areas; avoid audio unless recording law is met	30 to 90 days unless under a hold
Keystroke, screen capture, productivity scoring	Heavy intrusion, error, morale, bias in AI scoring	Narrow purpose, notice that names it, human review of any decision	Shortest period that serves the stated purpose
Location and vehicle telematics	Tracking off duty	Switch off outside work hours; separate personal and company use	Per policy; 90 to 180 days is common
Biometric time clock or door entry	State biometric laws, breach of unchangeable data	Written policy, written release, public retention schedule; use a badge if it does the job	Destroy at the end of the purpose and no later than the statutory outer limit
Personal devices under BYOD	Seeing personal data	Manage the work container only; document what you can and cannot see	Remove company data at exit

The retention figures in that table are common practice ranges, not legal requirements, and are labeled as my judgment, not a sourced standard. The legal anchors are the notice laws above and the schedule rules in the earlier table.

Children's and biometric data as records problems

These two data types share one feature: the law sets an outer limit on keeping them and requires a written policy.

For children's data, the COPPA Rule at 16 CFR 312.10 says an operator may keep personal information collected online from a child only as long as reasonably necessary to fulfill the specific purpose it was collected for, must delete it with reasonable measures against unauthorized access, and may not retain it indefinitely. At a minimum the operator must establish, implement and maintain a written data retention policy that sets out the purposes, the business need for retaining the information and a timeframe for deletion, and must provide that policy in the website notice. The amendments were published in the Federal Register on April 22, 2025 (90 FR 16918), took effect June 23, 2025, and carry a compliance date of April 22, 2026, with a few listed exceptions. I read the regulation text on Cornell's site and the dates on the Federal Register page. A firm with a kids' app, a youth program signup or a school sports site is the typical small operator in scope. Lesson 06 covers when COPPA applies.

For biometrics, the Illinois Biometric Information Privacy Act (BIPA), 740 ILCS 14/15, requires a private entity that holds biometric identifiers or information to have a publicly available written policy with a retention schedule and destruction guidelines, and to destroy the data when the initial purpose has been satisfied or within 3 years of the individual's last interaction, whichever comes first. Section 15(b) requires written notice of the purpose and duration and a written release before collection. Damages under section 20 are liquidated damages of $1,000 or actual damages for a negligent violation and $5,000 or actual damages for an intentional or reckless one. The statute as published also lists Public Act 103-769, effective August 2, 2024, which treats repeated collection of the same biometric data from the same person by the same method as a single violation with at most one recovery. I did not verify how courts apply that change to older claims, so that point is unverified. Other states regulate biometrics in different ways, covered in lesson 07, and lesson 13 covers the program side of biometrics.

Questions to ask your IT provider or vendor

• Which systems hold email, chat, files and logs, and what is the automatic deletion setting on each? Can you show it on screen?
• How fast can you suspend deletion for a named list of people and systems, and how do you record the date and the person who did it?
• How long do our backups last, what is the longest record class in each set, and what happens when we must erase one record from a backup?
• What does "delete" mean in each SaaS tool we use? How long are copies kept, and do you have a written statement from the vendor?
• Do you hold a log of media wipes and disposals, with certificates, against the current NIST SP 800-88 revision?
• Which monitoring tools are turned on, what do they capture, who can read the data and how long is it kept?
• When we hire in a new state, who checks for that state's monitoring notice rule and updates our notice?

Questions and answers

How long should we keep business email?

No single federal rule sets a period for business email as a class. Keep any message that is part of a record with its own minimum, such as a payroll approval or an I-9 correction, for that period. For the rest, choose a period you can defend, often 3 to 7 years, and write the reason. A shorter period cuts discovery cost and breach exposure. A longer one helps with contract disputes. Either way, a hold overrides it.

What is the cheapest first step toward a retention schedule?

Build the table of the 10 to 15 record classes you hold, put the legal minimum next to each one from the table in this lesson, and choose a disposal date. Run it once on the easiest system, such as old job applications. One real purge with a log teaches more than a long policy.

Does a hold have to be in writing?

Nothing in Rule 37(e) says the notice must be written, but the rule turns on reasonable steps, and a written notice with acknowledgments is the plainest proof of them. An oral instruction leaves nothing to show later.

Do we have to keep everything forever once a hold starts?

Only the records the hold covers, and only until it is released. Scope it by people, systems and date range. A hold on every record in the company is hard to run and costly to review, and Rule 26's proportionality language supports narrow, well-reasoned scope.

Can employees refuse a monitoring notice?

Not in a way that blocks the monitoring in states where notice is the requirement. The notice laws require you to give notice and, in New York and Delaware's one-time route, to get an acknowledgment. Make the acknowledgment part of onboarding, with the policy. If someone will not sign, record that you gave the notice, and talk to them about the policy.

Is a fingerprint time clock worth it?

Only if a badge, PIN or phone app cannot do the job. A fingerprint cannot be reset after a breach, and in Illinois the statute adds a written release, a public schedule and statutory damages. If you use one, treat the retention schedule as part of the install.

What if an employee asks us to delete their data and we are under a hold?

Answer within the legal time, delete what the hold does not cover, tell the person that some records are retained for a legal reason, and log the decision. The exact exceptions differ by state and are unverified here.

Do we need to keep the monitoring data we collect?

Keep it as long as the stated purpose needs and no longer. Security logs usually justify months. Camera footage usually justifies weeks. A hold changes that for the footage or logs tied to an event.

Hard questions

If we delete on schedule and a dispute comes later, won't it look like we hid something?

Not if the schedule is written, was in place before the dispute and ran on its regular cycle. That is what routine, good-faith operation means, and it is the exact fact pattern the Idaho state-court rule protects and the federal rule treats as reasonable. The risk is deleting after the dispute is foreseeable, or changing the schedule at the last minute. A deletion log with dates is your evidence.

Our IT provider says backups cannot be edited. Does the schedule still bind us?

The schedule binds the record, wherever the copy sits. If an immutable backup keeps a record past its disposal date, document that as an exception with an end date, keep the backup out of day-to-day access, and make sure the backup's expiry lines up with the longest class it holds. If a record must be erased on a legal demand and the backup cannot do it, say so in the response and give the date the backup will expire. I did not find a rule that excuses backups, so I would not claim one.

Doesn't a hold create a pile of data we then have to protect and produce?

Yes, which is why scope matters. A hold keeps the data, and the data stays exposed to a breach and to discovery. Narrow the custodians and the date range, store held data in a restricted location, and release promptly. The alternative, losing the data, costs more under Rule 37(e).

Is employee monitoring worth the legal exposure?

For security logging, yes, and the exposure is small if the notice is clear and access is narrow. For keystroke tracking, screen capture or scoring by software, the benefit is often unclear and the exposure is real: state notice penalties, labor-law claims about chilling protected talk, bias in automated scoring, and the morale cost. Start with the least intrusive tool that meets the stated purpose. Leaders who cannot say what a tool is for should switch it off.