Keep or Kill
Twelve things your organisation is still holding. Delete, keep, hold or minimise — and notice how often the right answer is none of delete-or-keep, because stripping the identifiers beats arguing about the period.
1. CVs and interview notes from candidates you rejected fourteen months ago. No complaint, no claim, no contact since.
2. Card numbers stored against completed orders, kept so returns are smoother.
3. Payroll records for current employees.
4. Customer support transcripts from six years ago, sitting in a warehouse that now feeds a live fraud-pattern model.
5. Employee records for someone who left two years ago, in a jurisdiction where employment claims can be brought for six.
6. The contract, invoices and contact details for a supplier you are actively buying from.
7. Everything within the scope of a regulatory investigation notice that arrived last month.
8. The e-mail mailbox of an employee who left three months ago, kept intact because her successor occasionally needs a thread.
9. Everything relating to a customer who is suing you.
10. Health information collected for a workplace adjustment that ended when the employee changed role two years ago.
11. Website analytics with full IP addresses, retained twenty-six months by default because nobody changed the setting.
12. CCTV from the loading bay covering the night of a theft now with the police, forty days old against a thirty-day schedule.
13. Marketing consent records for people who unsubscribed last year.
14. Financial records from nine years ago, where your obligation runs to seven and nobody has ever looked at them since.
15. A machine-learning training set built from customer messages, still in use, containing names and account numbers in free text.
Periods are illustrative: statutory retention differs by jurisdiction, sector and record type, and your own schedule beats any example here. What transfers is the reasoning — purpose first, obligation second, and minimisation as the answer that is usually better than either.