How do you build a retention schedule for records containing PII so it satisfies both the records schedule and privacy storage-limitation rules?

Building a retention schedule for records that contain personally identifiable information (PII) means reconciling two ideas that usually point in the same direction but sometimes pull apart. A records schedule asks, “How long must we keep this to meet legal, operational, and historical needs?” Privacy storage-limitation principles ask, “How can we avoid keeping personal data longer than necessary?” A defensible schedule answers both at once.

Start with the record, not the data field

Define the records series by business function and the activity it documents, just as you would for any schedule. Identify the minimum retention required by statute, regulation, or operational need, and the trigger event that starts the clock (for example, case closure or end of fiscal year). This is the floor below which you cannot delete.

Apply storage limitation as a ceiling

Storage-limitation rules treat personal data as something to minimize. So once you have established the required retention floor, do not pad it. Avoid open-ended or “permanent until reviewed” periods for PII unless a genuine legal or archival need justifies them. Where a series serves multiple purposes, set the period to the longest legally required need, then dispose promptly when it lapses.

Reconcile the two

When privacy minimization and records requirements conflict, the binding legal retention obligation generally controls, but it should be applied narrowly. Useful techniques include:

• Segregating PII into its own series so the broader record can be kept while identifiers are purged or anonymized earlier.
• Applying de-identification or redaction at a defined point instead of full deletion.
• Documenting the legal basis for each retention period so the schedule withstands audit and privacy review.

Operationalize and document

A schedule only satisfies storage limitation if disposition actually happens. Build automatic disposition triggers, log destruction, and review the schedule periodically as laws and systems change. Coordinate records, privacy, legal, and security stakeholders so the schedule is approved jointly.

For related guidance, see the privacy and PII topic hub.

In short: let the records schedule set the minimum, let privacy principles cap the maximum, document every period’s legal basis, and enforce timely, logged disposition.