Why does retention need a rule?
Without a rule, two things happen. Some teams delete records too early and then cannot answer an audit or a legal claim. Others keep everything forever, and old files with personal data pile up where they are a risk. A written schedule gives a clear answer to “can we throw this away?”
What decides how long to keep a record?
Three sources set the period. Take the longest that applies.
- The law. National rules on tax, accounting, employment, company or charity records and data protection. Laws differ by country, so check the rules where you are registered and where you work.
- Donor agreements. Many agreements require records for a set time after the end of the grant or the final payment. Read the clause for each donor.
- Your own policy. Some records matter to your organization longer than the law requires, such as founding documents and board minutes.
When two sources conflict, keep the longer period for that record.
What does a retention schedule look like?
A schedule is a table. The periods below are placeholders to show the layout, not advice. Set yours from the sources above.
| Record type | Period | Reason | After the period |
|---|---|---|---|
| Founding and registration documents | Permanent | Proof of existence and mandate | Archive |
| Board minutes and decisions | Check rules; often long | Governance evidence | Archive |
| Grant agreements and reports | Per donor clause | Donor requirement | Review, then destroy |
| Financial records and invoices | Per law and donor | Audit and tax | Review, then destroy |
| Staff contracts and files | Per employment law | Legal duty | Review, then destroy |
| Recruitment records of unsuccessful candidates | Short, per data rules | Fairness and data minimization | Destroy |
| Beneficiary personal data | Only as long as needed | Data protection | Delete or anonymize |
How to build your schedule
- List your record types. Go department by department.
- Find the rules. Check law and each donor agreement for periods. Ask a local adviser where unsure.
- Set the period. Choose the longest that applies and write the reason beside it.
- Decide the end action. Destroy, delete, anonymize or archive permanently.
- Name the owner. One person per record type makes sure the rule is followed.
- Approve and publish. Get leadership approval and tell staff.
- Review yearly. Update when a law, an agreement or a program changes.
How do you dispose of records safely?
Disposal needs care as well as a rule.
- Check for holds. Do not destroy anything tied to an open audit, dispute, investigation or claim. Pause disposal until it is closed.
- Dispose of paper securely. Shred paper with personal or financial content.
- Delete digital files properly. Remove them from all places they live, including shared folders and exports, and not only the main folder.
- Record what you destroyed. Keep a short log: what, when, by whom and under which rule.
- Include copies. Backups and email attachments may hold the same data.
What about personal data?
Data protection rules in many countries say that personal data should be kept only as long as there is a good reason. For people you serve, ask whether you still need names and contact details after a project closes. If you only need results, anonymize the rest. See our article on data protection basics for NGOs. Also check how your records tie into your document organization, since a clear structure makes disposal far easier.
A short example
A project ends in June. Its grant agreement says records must be kept for a set number of years after the final report, and national tax rules set a different period for financial records. The team keeps financial records for the longer of the two, and notes both reasons in the schedule. The beneficiary list holds names and phone numbers. The project needs only the totals now, so the team anonymizes the list and deletes the contact details.
Months later the donor asks for an invoice. It is there, filed in the right place, with its retention date visible. Nobody had to search, and nothing was kept without a reason.
Review the schedule when a new donor signs, since a new agreement can change the period for a whole group of records. Keep a short note of each change and the date it took effect.
Where EMPOBase fits
EMPOBase lists Document Retention among its Governance & Compliance features, and its Documents area has spaces and an Expiry Tracker for dates. Read about how the platform handles records or review the security page. The software does not know your country’s retention law or your donor clauses, so you must set the periods yourself, and you should check any required periods with a local adviser.