Purpose of This Template
You're managing a hybrid workforce, digitizing operations, and still finding boxes of paper records in storage closets, offsite facilities, or employees' homes. These records remain your liability under the General Data Protection Regulation (GDPR), Health Insurance Portability and Accountability Act (HIPAA), and other frameworks that don't distinguish between digital and physical media when defining "personal data" or "protected health information."
This template provides a policy for identifying, classifying, retaining, and destroying paper records. It's based on core GDPR principles that often challenge organizations managing legacy files: storage limitation (Article 5(1)(e)), integrity and confidentiality (Article 5(1)(f)), and accountability (Article 5(2)).
The Irish Data Protection Commissioner's investigation into the Health Service Executive highlighted the consequences of lacking this policy. Records were found "contaminated by animal droppings," stored in "disused bathrooms and cubicles," and kept in facilities without "functioning lighting or heating." The DPC issued $750,000 in fines and ordered a complete audit of all storage facilities. Implement structured retention controls to avoid such outcomes.
Prerequisites
Before implementing this policy, ensure you have:
A records inventory. You can't create retention schedules without knowing what you're retaining. Conduct a physical walkthrough of every location where your organization stores paper files, offices, warehouses, offsite storage, and employees' homes if they've taken files for remote work. Document what's there, how it's organized, and who's responsible for each location.
Legal retention requirements mapped to record types. Different records have different mandatory retention periods. For example, medical records under HIPAA might require retention for six years from creation or last treatment date. Financial records under Sarbanes-Oxley might require seven years. Employment records vary by jurisdiction. Work with legal counsel to map these requirements before writing destruction timelines.
Executive sponsorship. This policy will require a budget for secure storage, shredding services, and potentially offsite destruction vendors. It'll also require staff time to execute audits and destruction procedures. Secure leadership commitment before rolling this out, or it'll sit unused while records continue rotting in basements.
The Template
PAPER RECORDS RETENTION AND DESTRUCTION POLICY
1. SCOPE
This policy applies to all paper records containing personal data, protected health information, financial data, or other sensitive information, regardless of storage location (onsite, offsite, employee residence, third-party facility).
2. ROLES AND RESPONSIBILITIES
2.1 Records Custodian (Department Head or Designee)
- Maintain inventory of all paper records under their control
- Ensure records are stored in secure, climate-controlled facilities
- Execute destruction procedures when retention periods expire
- Report security incidents involving paper records within 24 hours
2.2 Compliance Officer
- Maintain master retention schedule
- Conduct annual audits of storage facilities
- Approve destruction requests
- Coordinate with legal on litigation holds
2.3 Information Security
- Define physical security requirements for storage locations
- Approve third-party destruction vendors
- Witness and document destruction events
3. RETENTION SCHEDULE
Record Type | Retention Period | Legal Basis | Destruction Method
------------|-----------------|-------------|-------------------
[Medical records - active patients] | [6 years from last treatment] | [HIPAA Security Rule] | [Cross-cut shred or incineration]
[Employee personnel files] | [7 years from termination] | [Local employment law] | [Cross-cut shred]
[Financial transaction records] | [7 years from fiscal year end] | [SOX, GLBA Safeguards Rule] | [Cross-cut shred]
[Marketing consent records] | [2 years from [consent withdrawal](/glossary/consent-withdrawal)] | [GDPR Article 7(3)] | [Cross-cut shred]
[Vendor contracts - expired] | [3 years from expiration] | [Internal policy] | [Cross-cut shred]
4. STORAGE REQUIREMENTS
4.1 Approved Storage Locations
- Records must be stored in facilities with:
* Controlled access (badge, key, or lock)
* Climate control preventing mold, water damage, pest infestation
* Fire suppression systems
* Organized filing system enabling retrieval within 48 hours
4.2 Prohibited Storage Locations
- Disused buildings without active environmental controls
- Shipping containers or temporary structures
- Employee vehicles
- Unsecured basements, attics, or storage rooms
4.3 Remote Work Exceptions
Employees working from home may retain active case files for up to 30 days if:
- Files are stored in locked cabinets when not in use
- No files contain more than 50 individual data subject records
- Employee acknowledges responsibility via signed agreement
- Files are returned to approved storage within 30 days or upon case closure
5. DESTRUCTION PROCEDURES
5.1 Scheduled Destruction
- Compliance Officer reviews retention schedule quarterly
- Records Custodians receive destruction notices 60 days before expiration
- Custodians pull files, verify against inventory, submit destruction request
- Compliance Officer approves request, checks for litigation holds
- Information Security witnesses destruction, obtains certificate of destruction
- Certificate filed for 3 years as evidence of compliance
5.2 Emergency Destruction
If records are compromised (water damage, pest infestation, unauthorized access):
- Records Custodian immediately secures affected materials
- Compliance Officer assesses whether breach notification is required under [72-Hour Notification Requirement](/glossary/72-hour-notification-requirement)
- If retention period hasn't expired, create digital copies before destruction where feasible
- Destroy compromised originals via approved method
- Document incident and destruction in compliance log
5.3 Approved Destruction Methods
- Cross-cut shredding (minimum DIN P-4 security level)
- Pulping
- Incineration at certified facility
- Third-party destruction service with certificate of destruction
6. AUDIT AND COMPLIANCE
6.1 Annual Storage Audit
Compliance Officer conducts physical inspection of all storage locations, verifying:
- Environmental controls functioning
- Access logs maintained
- Inventory matches physical files
- No records past retention expiration
- No unauthorized storage locations
6.2 Quarterly Inventory Reconciliation
Records Custodians submit updated inventories showing:
- New records added
- Records destroyed
- Records transferred between locations
6.3 Breach Response
Any unauthorized access to paper records triggers:
- Immediate incident report to Compliance Officer
- Assessment under GDPR Article 33 or applicable breach notification law
- Root cause analysis
- Corrective action plan
How to Customize It
Retention periods: The schedule above is illustrative. Replace bracketed periods with your actual legal requirements. If you operate across multiple jurisdictions, use the longest required retention period to simplify administration.
Record categories: Add rows for every type of sensitive paper record you create or receive. Common additions include research data, legal case files, audit reports, incident response documentation, and training records. If you can't categorize a record type, default to the longest retention period until legal counsel clarifies.
Storage locations: Section 4.1 assumes you have climate-controlled facilities available. If you're using offsite commercial storage, add vendor due diligence requirements: annual SOC 2 Type II audits, insurance coverage, right-to-audit clauses in contracts.
Remote work rules: The 30-day limit and 50-record threshold in Section 4.3 are conservative. Adjust based on your risk tolerance and operational needs. Some organizations prohibit all paper files at home. Others allow indefinite retention with enhanced controls (home safes, encrypted scans as backup). The key is defining the rule explicitly so you can audit against it.
Destruction methods: DIN P-4 cross-cut shredding is sufficient for most commercial records. If you handle classified information or extremely sensitive medical records, consider DIN P-5 or P-6, or move straight to incineration.
Validation Steps
You've drafted the policy. Now prove it works:
Test retrieval times. Pick five record types from your inventory at random. Ask the Records Custodian to retrieve them. If it takes longer than 48 hours, your filing system isn't "organized" under GDPR Article 5(1)(f). Reorganize before you call the policy operational.
Simulate a Data Subject Access Request. Ask a colleague to submit a mock request for all paper records containing their information. Execute your search procedures. If you can't locate responsive records within 30 days, you're not meeting GDPR Article 15 timelines. Fix your inventory tracking.
Conduct a destruction dry run. Select expired records, complete the destruction request workflow, and execute the procedure with a witness. Obtain the certificate of destruction. If any step breaks down, document the gap and revise the policy.
Audit a remote worker. If you allow paper files at home, schedule an unannounced compliance check. Verify the employee has locked storage and hasn't exceeded the record count limit. If you find violations, your remote work controls are too loose.
Run a tabletop breach scenario. Present this scenario to your team: "An employee reports finding moldy files in a storage closet. What happens in the next 72 hours?" Walk through notification requirements, containment steps, and destruction procedures. If anyone hesitates or gives conflicting answers, you need more training before the policy goes live.
The Irish DPC ordered the HSE to "carry out a complete audit of all storage facilities" and implement a "robust" system to "record and trace all data being stored." That's regulatory language for "you should've had this policy five years ago." Don't wait for a $750,000 fine to build yours.
