Data Retention Starter Checklist

Published July 29, 2026 · HI Tech Hui · ~6 min read · Tick the boxes as you go — your progress is saved in this browser.

Why old data is a liability, not an asset

Keeping everything forever feels cautious, but it works against you. Data with no active business or legal purpose cannot make you money — it can only be stolen, leaked, or subpoenaed. Every account, spreadsheet, and backup full of old customer and financial records is more surface area for an attacker, and more material a court can demand in a dispute that has nothing to do with why the data was collected. The security term for the fix is data minimization: keep what you need, for as long as you actually need it, on purpose — and get rid of the rest deliberately instead of by accident.

The part that actually requires a professional is deciding how long is long enough. That answer changes by record type, industry, state, insurer, and contract terms, which is exactly why this is a checklist of questions rather than a set of answers.

1. Financial & tax records

The IRS generally advises keeping records that support a tax return for three years from filing, extending to six years if income was underreported by more than 25%, seven years for a bad-debt or worthless-securities deduction, and indefinitely if a return was never filed or was fraudulent. Employment tax records carry a separate four-year minimum. These are general federal starting points, not your final answer — ask your CPA to confirm what applies to you.

• Ask your CPA: given our specific tax situation, what retention period should we actually use for returns, receipts, and supporting records — the federal minimum, or something longer?
• Ask your CPA: do any of our past filings (amended returns, disputed deductions, carried-forward losses) extend our retention window beyond the standard period?
• Ask your CPA: which records should be kept permanently — formation documents, ownership records, major contracts, property records — versus which can eventually be purged?
• Ask your bank or payment processor: do they require you to retain transaction records, chargebacks, or statements for a minimum period on your end?

2. Customer & sales records

A customer record with no active relationship, warranty period, or legal hold attached is usually the easiest category to reduce — and often the largest.

• Ask your attorney: what is the statute of limitations for contract or warranty disputes in Hawaii, and does that set a floor for how long we should keep customer transaction records?
• Ask internally: do we still have an active business reason to hold records for customers we have not served in one, three, or five years?
• Ask your attorney: if we accept credit card payments, store payment card data, or handle personal information, do PCI DSS or any state privacy law create separate retention or minimization obligations?
• Ask internally: where does customer data actually live — CRM, email, spreadsheets, old POS exports — and does every copy get covered by whatever retention period we land on, or just the "official" one?

3. Employee & HR records

Employment records tend to have the longest and most fragmented retention rules of any category, because federal, state, and insurance requirements overlap.

• Ask your employment attorney: what does Hawaii state law require for personnel files, I-9 forms, and hiring records — separately from any federal minimum?
• Ask your workers' comp insurer: do they require records to be kept longer than the general minimum, especially after a claim or workplace injury?
• Ask your CPA or HR advisor: are payroll tax records, timesheets, and wage documentation being retained for the correct federal minimum, and are they stored separately from unrelated personnel files?
• Ask internally: do we have a consistent point at which a departed employee's records get archived or purged, or does it vary person to person?

4. Industry-specific & regulated data

If your business touches healthcare, payments, insurance, or another regulated space, general rules of thumb stop applying and specific frameworks take over.

• If you handle protected health information: ask your compliance advisor how HIPAA's six-year rule for administrative documentation (policies, training records, risk assessments) interacts with Hawaii's separate medical-record retention law, since HIPAA does not set the medical-record period itself.
• If you accept card payments: ask your payment processor or QSA what PCI DSS actually requires you to retain versus purge, since PCI leans toward minimizing stored cardholder data rather than keeping it.
• If you hold professional or contractor licenses: ask your licensing board or attorney whether project files, inspection records, or client communications carry a mandated retention period tied to the license.
• Ask your insurance broker: does your cyber liability or E&O policy require specific data handling or retention practices to remain in force after a claim?

5. Where the data actually lives

A retention decision only matters if it reaches every place the data was copied to. This is the part your IT provider can help execute once the retention periods are decided.

• Do we know every system that holds customer or financial data — production systems, backups, archived email, exported spreadsheets, old laptops, and departed employees' accounts?
• When a record is deleted from the "live" system, does it also age out of backups eventually, or does it sit in backup storage indefinitely?
• Do we have a way to search for and delete a specific customer's data across systems if a retention period expires or a deletion request comes in?
• Is there a documented, repeatable process for secure deletion — not just moving files to a folder called "old" — once your CPA or attorney confirms a record is past its required retention period?

6. Writing it down

Once you have real answers from your CPA and attorney, the last step is putting them in writing — but that document should come from them, shaped around your specific business, not from a generic template.

• Ask your attorney or CPA to help translate the answers above into a short, written retention schedule by record type — specific to your industry, state, and contracts.
• Ask who inside the business owns keeping that schedule current as laws, insurers, and contracts change.
• Calendar an annual review with your CPA or attorney so the schedule does not go stale the way most of these do.

The one habit that matters most

You do not need a perfect answer today. You need to stop the default of "keep everything because deleting things feels risky." Every piece of customer or financial data sitting around with no active purpose is doing nothing for your business except waiting to be part of a breach notification. The businesses that handle this well are not the ones with the longest retention policy — they are the ones who actually know what they are holding, why, and for how long, because they had the conversation above with someone qualified to answer it.

The pattern to watch for

If you cannot name, off the top of your head, roughly how old your oldest customer record is or where your last five years of financial exports actually live, that is the signal to have this conversation sooner rather than later — before a breach, an audit, or a subpoena forces the question.

Related reading

• Which compliance framework actually applies to your Hawaii business?
• HIPAA IT controls for Hawaii medical practices in 2026
• Vishing Scams: Team Training — scam-call scripts for your next team meeting
• Hawaii ransomware recovery: the first 72 hours

Want help figuring out where your customer and financial data actually lives, or executing a retention schedule once your CPA and attorney confirm it? HI Tech Hui provides managed IT, cybersecurity, and 24/7 monitoring through our in-house SOC for Hawaii businesses. Call (808) 206-8549, email info@hitechhui.com, or schedule a discovery call. We are at 401 Kamakee St Suite 206, Honolulu, HI 96814.

This page is educational and general in nature. It is not legal, tax, or accounting advice, and HI Tech Hui does not provide legal, tax, or compliance determinations. Retention requirements vary by industry, state, insurer, and contract — confirm the specifics that apply to your business with your own CPA and attorney. Federal retention figures referenced above come from the IRS and HIPAA Journal.