Retention and Deletion

Time records carry a retention obligation measured in years, and the obligation differs by what the data is and where the person works.

The categories, which differ

The statutory record of hours: years, set by the jurisdiction.

Payroll-relevant calculations: usually the same or longer.

Project attribution and narratives: driven by billing and tax rather than employment law.

Approval and edit history: as long as the record it describes, or the audit trail is incomplete.

Derived reports: shorter, frequently much shorter.

Access logs: their own period, and they are personal data about the people who looked.

Any monitoring data, if it exists: shortest of all, and it rarely has a justification beyond the current period.

What a product must support

Retention configurable per data category, not one setting for everything.

Per jurisdiction, where you employ in more than one. A single global period either deletes what someone is required to keep or keeps what someone is required to delete.

Automated deletion, with a report of what was removed.

A legal hold that overrides deletion for a specific matter, scoped and releasable.

Ask for each of these specifically. Products commonly offer one number and a manual purge.

Making deletion real

Automated, because manual deletion does not happen.

Verified: attempt to retrieve something past its period and confirm it is gone rather than hidden from a report.

Including backups, which is where retained data survives a deletion policy and is the gap auditors find.

Including exports, which is the other gap: a period exported to a spreadsheet for a manager is outside every control the system has.

Legal hold

Applied before the automation runs, which requires whoever handles disputes to be part of the process.

Scoped: specific people, specific period, specific matter.

Released when the matter ends, verified, because indefinite holds accumulate and quietly defeat the schedule.

Tested by applying one and confirming the retention job respects it.

On departure and at contract end

A leaver's account is disabled; their record is retained for the statutory period. These are different decisions and products conflate them.

At contract end the vendor deletes, confirmed in writing, including backups — and the deletion date must be checked against the statutory obligation, which outlives the contract.

What to report

Holdings by category and age.

Deletion executed, as a periodic report rather than an assumption.

Active holds with their age. A hold older than its matter is a finding.

Exports outstanding, which is the leak nobody tracks.

Test a deletion

The check that distinguishes a policy from an intention.

Find a record past its retention period.

Confirm it is actually gone, not merely hidden from a report.

Check the backups, which is where retained data survives a deletion policy.

Check exports, which is the other gap: a period sent to a manager as a spreadsheet is outside every control the system has.

Do it annually and record the result.

Retention follows sensitivity

Sector context changes what is proportionate to retain. A review of healthcare time tracking software should include screenshots, access logs and deletion behaviour, not only hours.