A document retention policy should tell people what to keep, where to keep it, and who can authorize disposal. It needs to cover the places your nonprofit actually stores information: email, shared drives, messaging tools, paper files, work on personal devices, and outside providers. A retention schedule is hard to follow if nobody knows which copy to keep.

Map your records before setting a schedule

Identify the main categories of records, such as governance, finance, grants, employment, contracts, programs, and participant information. For each, note its owner, storage location, access permissions, and any existing retention requirement. Foundations should include grantmaking and due-diligence records. Look for duplicated files and accounts that could become inaccessible when someone leaves.

Ask counsel and relevant advisers to determine appropriate retention periods. Requirements can depend on jurisdiction, funding agreements, the record type, and pending matters. Do not assume that a single period fits every file or that a template’s schedule applies unchanged to your organization.

Distinguish routine disposal from preservation

Explain who can authorize routine disposal and how it is documented and carried out securely. Include vendors and automatic deletion settings in the procedure. People need a practical way to raise a preservation question before files are removed.

When litigation, an investigation, or another preservation obligation arises or is reasonably anticipated, obtain prompt legal direction. Counsel should identify the records and systems to preserve and advise on suspending relevant deletion practices. A routine retention policy must not be used as a reason to destroy potentially relevant information.

Adapt an established nonprofit template

Public Counsel’s annotated records management and retention policy includes explanatory notes and editable policy, appendix, and schedule files. Read the annotations before adapting the form. They explain assumptions and alternatives that may be lost if someone copies only the sample language.

Use the template as a discussion document for the people who manage records and the lawyer reviewing the policy. Test it against a few ordinary tasks: retaining a grant agreement, closing an employee account, responding to a document request, and disposing of an old program file. Clarify ambiguous responsibilities before adoption.

Put the policy into daily use

Follow the appropriate approval process, distribute the current version, and train staff and board members on the actions relevant to them. Assign responsibility for implementation and periodic review. Keep preservation instructions distinct from ordinary schedules and provide a reliable escalation contact. Specific retention and preservation decisions require qualified legal guidance.

Explore the Nonprofit & Foundation Resilience guide for related resources. For strategic or crisis communications support, contact Caitlin at CBKStrategies.

Back to all resilience resources · Home · About CBKStrategies

Back to all resilience resources