Archival best practices for legal records come down to four disciplines working together: a defensible retention schedule that says what to keep and for how long, preservation methods that keep those records intact and authentic, a legal hold process that stops destruction the moment litigation becomes foreseeable, and documented destruction once retention expires and no hold applies. Get these right and your records stay findable, admissible, and out of court sanctions. Get them wrong and you face spoliation orders, regulatory penalties, or in the worst case, criminal liability.
Deciding What to Keep and for How Long
A retention schedule is the foundation. It assigns each type of record a minimum retention period based on whichever is longer, the legal requirement or the operational need, and it documents the reasoning behind each period so an auditor or regulator can see how the decision was made.1National Archives. Record Values A contract governed by a six-year statute of limitations, for instance, should be retained for at least six years after it expires or terminates.
The schedule is also what gives you legal cover to destroy records once their period runs out. Without one, organizations either hoard everything, which drives up storage costs and expands the discovery surface in litigation, or they destroy records ad hoc, which invites spoliation claims. A written schedule, reviewed and updated when regulations change, is the difference between routine disposition and suspicious destruction.
Signed contracts, corporate formation documents, intellectual property filings, and legal opinions almost always warrant long-term or permanent retention because they prove what an organization agreed to do or is entitled to receive. Everything else needs a defensible period tied to a specific legal or operational rationale.
Federal Minimum Retention Periods
Several federal laws set specific floors. State law, industry regulation, and contracts can extend them, but you cannot go below these.
Tax Records
The IRS requires taxpayers to keep records as long as they may be material to tax administration, which usually means the applicable period of limitations. The standard assessment period is three years from the filing date. If unreported income exceeds 25% of gross income shown on the return, or is attributable to foreign financial assets over $5,000, the period extends to six years. Bad debt deductions and losses from worthless securities carry a seven-year refund claim period. There is no limitation period when a return is fraudulent or was never filed.2Internal Revenue Service. Topic No 305 – Recordkeeping
Organizations storing tax records electronically must meet the IRS’s electronic storage requirements: integrity controls, protection against unauthorized alteration, and an audit trail linking source documents to the general ledger. If the organization later abandons the hardware or software needed to retrieve those records, the IRS treats the records as destroyed.3Internal Revenue Service. Revenue Procedure 97-22
Employment Records
Under the Fair Labor Standards Act, employers must keep payroll records for at least three years. Records that explain wage differences between employees, including wage rates, job evaluations, and collective bargaining agreements, must be kept for at least two years.4U.S. Equal Employment Opportunity Commission. Recordkeeping Requirements Any pending or threatened employment claim should trigger a legal hold that overrides these baselines.
Health Information
HIPAA requires covered entities to retain documentation of privacy policies, required written communications, and records of required actions and designations for six years from creation or from the date the document was last in effect, whichever is later.5eCFR. 45 CFR 164.530 – Administrative Requirements Medical records themselves are governed by state law, and most states impose retention periods of seven to ten years for adult patient records.
Audit Workpapers
Accountants auditing publicly traded companies must maintain all audit and review workpapers for five years from the end of the fiscal period in which the audit concluded. Willful violations carry penalties of up to ten years in prison.6Office of the Law Revision Counsel. 18 USC 1519 – Destruction, Alteration, or Falsification of Records in Federal Investigations and Bankruptcy
Keeping Records Admissible
A record that survives is only useful if a court will accept it. Under Federal Rule of Evidence 901, the party offering a record must produce evidence sufficient to show it is what they claim it is.7Legal Information Institute. Federal Rules of Evidence Rule 901 – Authenticating or Identifying Evidence Two archival principles and a chain of custody are what let you meet that burden.
The first principle is provenance: records stay with the organizational unit that created them and are not rearranged by subject or some other artificial scheme.8National Archives. Principles of Arrangement The second is original order: if the legal department filed its contracts chronologically, you keep them chronological. That sequence itself is evidence of how the records were used.
Chain of custody documents the path from creation to production. At minimum, tracking should capture who created or collected the record, when custody transferred and to whom, where the record was stored at each stage, and what controls prevented tampering. For electronic records, log every access event, keep read-only originals, and maintain working copies in separate directories. Audit trail capabilities are a regulatory requirement for federal agencies under the electronic records management rules.9eCFR. 36 CFR Part 1236 – Electronic Records Management
Preserving Paper Records
The biggest factor in how long paper survives is the environment it sits in. Temperature swings and humidity fluctuations accelerate chemical deterioration in paper, adhesives, and inks. NARA’s archival storage standards specify that textual records should be stored between 50°F and 65°F with relative humidity between 30% and 50%.10National Archives and Records Administration. NARA 1571 Supplement 2 – Temperature, Relative Humidity and Air Quality Light exposure, especially ultraviolet, should be minimized. These ranges are tighter than typical office conditions, which is why dedicated archival storage matters for anything you plan to keep for decades.
Housing materials come next. NARA maintains detailed specifications for boxes, folders, and envelopes to ensure they don’t introduce acids or contaminants.11National Archives. Materials Specifications – Housing Enclosures for Archival Records Acid-free folders and lignin-free boxes are the standard. Handling rules matter too: gloves for photographs and fragile items, flat storage for oversize documents, no food or drink in storage areas.
Every program should identify its vital records, meaning the records needed to re-establish operations after a disaster, and give them extra protection. That means duplicate copies at a geographically separate location, fire-rated vaults for the most critical originals, and a written emergency response plan for water, mold, and fire recovery. For media approaching obsolescence, migrate the data to current media before the playback equipment disappears. Waiting until the last working machine fails is how organizations lose irreplaceable records.
Preserving Digital Records
Digital preservation is not passive storage. Format obsolescence, media decay, and silent bit-level corruption all require active management.
Stable Formats and Regular Migration
Converting records to stable, widely supported formats is the most important step. PDF/A, an ISO standard designed for long-term preservation of page-based documents, keeps a record’s visual appearance identical regardless of what software opens it years later.12Library of Congress. PDF/A Family, PDF for Long-term Preservation TIFF plays the same role for image-based records. Both are open standards, so you are not dependent on a single vendor.
Migration continues past format conversion. Federal regulations require agencies to develop migration procedures that preserve records and their metadata to avoid loss from media decay or technology obsolescence, and magnetic tape holding permanent records must be copied to new media before the originals reach ten years of age.9eCFR. 36 CFR Part 1236 – Electronic Records Management
Fixity Checks
Digital corruption can be invisible. A single flipped bit can silently alter a record with no visible sign of damage. Fixity checks use cryptographic hash algorithms such as MD5 or SHA-256 to generate a unique fingerprint for each file, and even the smallest change produces a completely different fingerprint.13National Digital Stewardship Alliance. Checking Your Digital Content – Fixity Guidance For legal records where admissibility depends on proving the file has not been altered, fixity checking is not optional. Run it on a schedule and log the results.
Storage Redundancy
The National Digital Stewardship Alliance’s Levels of Digital Preservation set the baseline. At the lowest level, maintain at least two complete copies in different locations. At the next level, keep at least three copies with at least one in a different geographic region.14National Digital Stewardship Alliance. The NDSA Levels of Digital Preservation Mature programs place copies in locations with different disaster threat profiles so a hurricane, earthquake, or flood at one site does not threaten all copies.
Storage rooms have their own environmental targets. Federal regulations specify a temperature range of 62°F to 68°F and relative humidity of 35% to 45% for media holding permanent or unscheduled records, along with smoke-free conditions.9eCFR. 36 CFR Part 1236 – Electronic Records Management These ranges are narrower than the paper standards because magnetic and optical media react more sharply to fluctuation.
Legal Holds and Litigation Preservation
A retention schedule tells you when destruction is allowed. A legal hold tells you when it is forbidden. This is where records management programs most often face serious consequences.
The duty to preserve arises when litigation is reasonably anticipated, not when a lawsuit is filed. Common triggers include a demand letter, notice of a regulatory investigation, or internal discussion of a likely claim. Once the duty attaches, the organization must immediately suspend routine destruction of anything potentially relevant.
What Sanctions Look Like
Federal Rule of Civil Procedure 37(e) governs the loss of electronically stored information that should have been preserved. If the lost information cannot be recovered through other discovery and the court finds prejudice, it can order measures to cure that prejudice. If the court finds the party acted with intent to deprive the other side of the evidence, the consequences escalate sharply: the court can instruct the jury to presume the destroyed information was unfavorable, or it can dismiss the case outright or enter a default judgment.15Legal Information Institute. Federal Rules of Civil Procedure Rule 37 – Failure to Make Disclosures or to Cooperate in Discovery
Negligent loss limits the court to proportional remedies. Intentional destruction opens the door to case-ending sanctions. That gap is why a well-documented hold process is essential: the notices and confirmations themselves become evidence that the organization took reasonable steps.
Running the Hold
An effective legal hold has four moving parts. Identify the scope: which custodians, which data sources, which time period. Issue written hold notices to every identified custodian, explaining what must be preserved and that routine destruction stops for those materials. Confirm compliance and follow up with anyone who doesn’t acknowledge the notice. Document everything, because courts evaluating whether reasonable steps were taken will look for the paper trail.
Modern data environments make scoping harder than it sounds. Records live in email, Slack channels, text messages, cloud collaboration tools, and personal devices. A hold that only covers the file server misses most of where business actually happens. Identifying every relevant source early is the step organizations most consistently underestimate.
Access, Confidentiality, and Redaction
Records exist to be used, but access has to be balanced against confidentiality obligations. Physical materials typically move through controlled reading rooms with pre-requested pulls, monitored handling, and logged reproduction. Digital access should be tiered so that an attorney on a matter sees the full record while a broader audience gets a redacted version. Court orders, statutory restrictions, and donor or client agreements can all impose time-limited access controls that the system has to enforce automatically.
Federal filings carry specific redaction requirements. Under Rule 5.2, any filing containing a Social Security number, taxpayer identification number, birth date, the name of a minor, or a financial account number must be redacted to show only the last four digits of the Social Security or taxpayer ID, the year of birth, the minor’s initials, and the last four digits of the account.16Legal Information Institute. Federal Rules of Civil Procedure Rule 5.2 – Privacy Protection for Filings Made with the Court HIPAA’s de-identification requirements reach further, covering eighteen categories including names, geographic data smaller than state level, telephone numbers, email addresses, and biometric identifiers.
One trap catches people repeatedly: drawing a black box over text in a PDF is not real redaction. The underlying text remains searchable and recoverable. Proper redaction removes the data permanently, including metadata and hidden objects, rather than just hiding it visually.
Destroying Records the Right Way
Once retention has expired and no legal hold applies, destruction should be prompt, documented, and irreversible. Keeping records past their period is not a safe default: it raises storage costs, broadens discovery, and enlarges the data breach surface.
For paper containing sensitive information, cross-cut shredding is the standard, and it provides more security than strip-cut. Recycling can be acceptable for non-sensitive material. Whatever the method, produce a certificate of destruction recording what was destroyed, when, how, and by whom. That documentation is what proves the destruction was routine and authorized rather than selective or suspicious.
Digital destruction is harder because deleting files or reformatting a drive does not actually remove the data. NIST Special Publication 800-88 sets the federal framework, defining three levels.17National Institute of Standards and Technology. SP 800-88 Rev 1 – Guidelines for Media Sanitization Clearing overwrites data so standard tools can’t recover it. Purging uses more aggressive techniques like cryptographic erasure or firmware-level secure erase to defeat even laboratory recovery. Physical destruction (degaussing, disintegration, incineration) eliminates the media entirely. Pick the level based on the sensitivity of the data and whether the media will be reused, transferred, or discarded.
Document digital destruction the same way you document paper. Record the media identifiers, method, date, and responsible person. If you use a third-party vendor, require certificates of destruction and confirm the methods align with NIST standards.
Criminal Exposure for Destroying Records
Everything above sits inside a legal framework that punishes willful destruction. Federal law makes it a crime to destroy, alter, or falsify any record with intent to obstruct a federal investigation or a bankruptcy proceeding, punishable by fine, up to twenty years in prison, or both.6Office of the Law Revision Counsel. 18 USC 1519 – Destruction, Alteration, or Falsification of Records in Federal Investigations and Bankruptcy The statute is broad. It covers any matter within the jurisdiction of any federal department or agency, and it does not require that a formal investigation already be underway. Acting in contemplation of such a matter is enough.
Civil spoliation sanctions can end a lawsuit. Criminal liability under 18 U.S.C. § 1519 can end a career. Organizations that avoid both treat records management as an ongoing compliance obligation: defensible retention schedules, prompt and documented legal holds, verified destruction only after retention expires and no holds remain, and thorough documentation at every stage.