Most companies we audit share one data retention policy: "we keep everything just in case." That's not a policy — it's the absence of one. And it costs real money, generates real risk, and can bite you in unexpected ways during a GDPR audit.
Data retention isn't a legal topic for corporations. It's an operational topic for any company that has email, a file share, an ERP and at least one employee. Below we show how to set rules in practice — rules you can roll out in a few days without buying new software or launching a three-month project.
Why it isn't just about GDPR
GDPR is the obvious reason to think about retention ("personal data kept only as long as necessary for the purpose"). But in the reality of a Polish SME, personal data is maybe 5% of the problem. The rest is:
- Backup cost. Backup scales linearly with data size. If you're storing 8 TB, of which 5 TB is old marketing files from 2019, you're paying to back up those 5 TB every month, forever.
- Search cost. Search in SharePoint, Outlook or the ERP gets worse the more junk it has to sift through. Copilot and internal AI suffer even more — they cite outdated documents as the source of truth.
- Leak risk. Data you no longer need can leak exactly like data you do. But no one benefits from that hole, and the damage is identical.
- Litigation risk. An old contract draft in an email archive that nobody remembered can suddenly become the key piece of evidence against you in a dispute with a former employee or supplier.
So retention isn't only about "how long am I allowed to keep it". It's also "how long should I keep it before I shoot myself in the foot."
Rule 1 — three buckets, not thirty
The biggest mistake we see: a company tries to set retention rules for every document type separately. After two meetings, a 40-page table is produced, filed under "company policies" and never opened again.
In practice, a 10–50 person company only needs three buckets:
- Accounting and tax data — sales and purchase invoices, KPiR ledger, JPK files, tax returns. Polish tax and accounting law is explicit: 5 years from the end of the year the tax obligation arose. Keep for 6, to be safe.
- HR data — personnel files, payroll. For employees hired from 2019 onwards: 10 years from the end of the year employment ended. For older cases: 50 years, unless a ZUS RIA report was filed. Don't try to shorten this — the labour inspectorate does not joke around.
- Everything else — emails, quotes, project files, drafts. Default rule: 3 years, unless you have a concrete reason to keep them longer. Three years covers most Polish Civil Code limitation periods for commercial claims.
Three buckets, three retention periods. Ninety percent of your data lives in bucket three — and that's where all the cleanup potential is.
Rule 2 — the law gives you a minimum, cost sets the maximum
Many business owners think about retention as a one-way legal obligation: "I have to keep X for at least Y years." That's only half the story.
GDPR pushes the other way: you're not allowed to keep personal data longer than necessary. If your CRM still holds an email address of a lead you spoke to once in 2018, and nothing came of it, you're technically in breach. In practice no one enforces this — until you have a leak and the Data Protection Authority takes an interest.
The same goes for HR data. Keeping the CVs of candidates you didn't hire "just in case, for the future," without a fresh consent, is a classic GDPR violation in SMEs. Two years after the interview, those CVs have no value — they're pure risk.
The takeaway: every category has a legal minimum (not shorter than X) and a common-sense maximum (not longer than Y). Retention is the window between them, not "as long as the disk can take."
Rule 3 — automate deletion, don't rely on discipline
A rule that nobody follows isn't a rule. It's a paragraph in a document.
In practice this means retention has to be built into your tools, not into your employees' to-do lists. Concretely:
- In Microsoft 365 / SharePoint — use Retention Policies (Purview). You can set "this folder: 3 years from last modification, then delete." It runs automatically — people don't even notice.
- In the ERP — most systems let you mark a customer as closed / archived, with automatic masking of personal data after X years without a transaction.
- In email — archive rules in Exchange or Google Workspace. "Messages older than 5 years in folder X: delete" is one rule, one click.
- In backups — a media retention policy: daily 30 days, weekly 12 weeks, monthly 12 months, yearly 6 years. The rest is purged automatically.
"Someone will clean out the folder once a quarter" never works. We've verified this in dozens of companies.
Rule 4 — email is not an archive
In a Polish SME, email is usually the single largest repository of company data. Not because it should be — because it is. Everything goes by email: contracts, quotes, invoices, tax filings, passwords, scans of ID cards.
That's a retention problem, but above all a problem of where this data lives. Email is not designed for storage. There's no versioning, no document-level permissions, no meaningful search inside attachments, no automatic classification.
The best thing you can do for email retention is to pull out what matters and put it where it belongs. Invoices → into the accounting system. Contracts → into the client folder in SharePoint. ID scans → into personnel files (and out of email). After that the email itself can live for a shorter time — because the important things already exist elsewhere.
A concrete example
At one of our clients — a 22-person engineering company using Microsoft 365 and Comarch Optima — a storage audit found 4.7 TB of data on SharePoint and OneDrive, of which 3.1 TB was files untouched for more than 5 years: mostly copies of old quotes, draft project versions, downloaded reports, and the entire pre-2018 archive from the on-prem file server migration.
Instead of a "big cleanup" project (which always dies within a week) we introduced three things: a Purview retention policy for project folders (5 years from project closure → delete), archive rules for mailboxes (older than 3 years → archive, older than 5 → delete), and a one-off cleanup of the "old projects" folder after a manual review by leadership (2 days of work, not a week).
After three months: backup volume dropped by 42% (from 4.7 TB to 2.7 TB), the monthly O365 storage cost fell by several hundred zloty, and SharePoint search started returning meaningful results in the top ten rather than on page three. On top of that, the company could for the first time honestly answer the GDPR auditor's question: "what are your retention periods for customer personal data?"
How to get started
A practical four-week path:
- Week 1. Take inventory: where does the data actually live. SharePoint / OneDrive / on-prem server / personal disks / email / ERP / CRM. Size of each. Without this, you don't know what you're dealing with.
- Week 2. Set the three retention buckets (accounting / HR / rest) and write them on a single A4 page. Agree the periods with your accountant and HR person to make sure they match the law.
- Week 3. Turn on the retention policies in the tools — first for email (easiest), then for SharePoint (Purview). Start with soft deletion (to trash) for a few weeks, to see whether anything important is disappearing.
- Week 4. Do a one-off cleanup of the biggest folder of old files. Invite department heads — they know best what's still needed and what's history.
Four weeks and a few hours a week to stop paying to back up 2019 data and get useful results out of your search.
When it's worth asking
Data retention in a company with a single Gmail inbox and a folder on the desktop is trivial. In a company with Microsoft 365, an on-prem file server, two ERPs, a cloud CRM and six people with "their folders on the network drive," it's a project. Not a hard one, but one that needs decisions — and it's better to make them with someone who knows the consequences of each option.
If you want to sort out retention at your company but don't know where to start — let's talk. The first call is free and takes half an hour.
Keeping "everything just in case" isn't caution — it's postponing a decision you pay a monthly backup bill for.