We found electronic records that should have been destroyed years ago, so what do we do now?

Finding records that were eligible for destruction long ago is common, and it is fixable. The key is to slow down: rushing to delete can be as harmful as keeping them too long. Treat this as a controlled cleanup, not an emergency purge.

First, do not delete anything yet

Before any deletion, confirm that nothing prevents disposal. Records that are past their retention date can still be frozen by other obligations:

• Active legal holds or litigation — preservation duties override a retention schedule.
• Open investigations, audits, or FOIA / public-records requests.
• Regulatory or statutory requirements that may run longer than your schedule assumes.

If any of these apply, the records must stay until the hold is lifted. Deleting records under hold can carry serious consequences, so verify with legal or compliance first.

Confirm the records really are eligible

Locate the applicable retention schedule and verify the record series, the retention period, and the event that starts the clock. Over-retained records sometimes turn out to be misclassified rather than truly expired. Make sure you understand what the data is, who owns it, and why it was kept.

Document the decision before acting

Defensible disposition rests on showing you followed a consistent, authorized process. Capture:

• The record series and the schedule authorizing destruction.
• Confirmation that no holds apply.
• Who approved the disposition and when.
• The method and date of destruction.

This disposition log is what protects the organization later. Destruction carried out under an approved schedule and properly documented is routine and expected; ad hoc deletion is what creates risk.

Then dispose securely and fix the process

For electronic records, “destruction” means complete, unrecoverable deletion, including copies in backups, archives, and cloud or collaboration tools where feasible. Use methods appropriate to the data’s sensitivity.

Finally, address the root cause. A backlog usually signals that disposition is not running on schedule. Build a recurring review cycle so eligible records are dispositioned routinely going forward, rather than discovered years later.

For more on managing the full lifecycle of digital records, see the electronic records topic hub.