Data Retention Policy: What Every Tax Preparer Should Have

Most firms handle data retention the same way: keep everything, forever, on the theory that deleting something you might need later is scarier than storing something you don't. That instinct is understandable, and it's also backwards. Every year of data your firm holds past the point it's actually needed is pure downside — more exposure in a breach, more to produce in an audit, and less clarity about what's actually still relevant. Here's what a real retention policy needs to cover.

Why "Keep Everything" Isn't a Safe Default

Under the FTC Safeguards Rule, having disposal procedures for client information is an explicit part of a firm's information security program — not a courtesy, a requirement. Beyond compliance, there's a plain risk-math argument: data you don't have can't be stolen, subpoenaed, or leaked. A firm that's still holding nine-year-old client bank statements it will never reference again has taken on all of the storage risk with none of the benefit. Retention policies exist to draw that line deliberately, instead of by accident.

Retention Isn't One Number — It's a Schedule by Record Type

The IRS's commonly cited three-year window applies to a fairly narrow situation, and treating it as a blanket rule is where most informal policies go wrong. A workable schedule breaks records into categories, because they don't share the same real-world retention need:

• Filed tax returns and supporting workpapers — typically 7 years, to cover the IRS's extended lookback for substantial underreporting or bad debt/worthless securities claims, not just the standard 3-year window
• Engagement letters and client contracts — for the life of the client relationship plus several years after, since these are often the first document pulled in a dispute
• Bank statements and source documents — long enough to support the return they back up, then eligible for destruction on the same schedule as the return itself
• PII collected but not tied to a specific filing — the shortest reasonable window, since this is the category with the least ongoing business justification for storage

A real policy sets a specific window for each category, tied to how your firm — and your state's requirements — actually work, rather than importing a generic number that doesn't match any of them exactly.

Destruction Has to Be as Deliberate as Storage

A retention schedule that only says when to delete something, without specifying how, isn't finished. Deleting a file from a folder usually isn't secure destruction — the FTC Safeguards Rule and most state disposal laws expect data to be rendered genuinely unrecoverable, not just moved out of a visible directory. That means different handling for paper (shredding) versus digital records (secure deletion or cryptographic erasure), and it means backups need to be part of the plan too — a purged file that still exists in six months of rolling backups hasn't actually been disposed of.

The Real Failure Point Is Enforcement, Not the Policy Document

Writing a retention schedule is the easy half. The hard half is actually acting on it — every system your firm's client data touches (practice management software, shared drives, email archives, a scanning app nobody remembers installing three years ago) needs to purge on the same schedule, and that almost never happens by someone remembering to do it manually during a busy season. This is exactly the kind of policy that looks complete on paper and quietly isn't followed anywhere in practice — which is why we build retention enforcement into a firm's actual systems and workflows rather than handing over a document and calling it done. A schedule that isn't tied to how your specific tools actually store and archive data is a schedule that won't get followed.

For the broader security requirements this connects to, see our FTC Safeguards Rule breakdown and our WISP checklist for small firms. This is also part of our complete guide to AI for accountants.

Frequently Asked Questions