What should we do if we find personal data kept years past its retention period during an inventory?

Finding personal data kept long past its retention period is common during an inventory, and it is a meaningful risk: data that no longer serves a business or legal purpose still carries privacy, security, and discovery exposure. The goal is to resolve it deliberately, not to delete on the spot.

Stop, document, and confirm the record

Do not immediately destroy anything. First, capture what you found: the system or location, the type of personal data, the volume, who owns it, and the retention rule that appears to apply. Confirm which records schedule and retention period actually govern the data. What looks “overdue” may be subject to a different category, a longer legal requirement, or an obligation you have not yet identified.

Check for any hold or active obligation

Before disposition, verify there is no legal hold, audit, investigation, open request, or pending litigation that requires preservation. A litigation hold or similar duty overrides routine destruction. Also confirm no statutory or regulatory minimum still applies. Disposing of data that should have been kept can be as serious as keeping data too long.

Authorize disposition through normal channels

If the data is genuinely past its approved retention and no hold applies, dispose of it using your organization’s documented disposition process, with the required approvals and a destruction log. For personal data, ensure the method is secure and irreversible (for example, certified shredding for paper or sanitization for electronic media), and that backups and copies are addressed, not just the primary system.

Treat it as a signal, not a one-off

Over-retention usually points to a process gap. Note whether the schedule was unclear, disposition never ran, or ownership was undefined. Feeding these findings back into your retention schedule and routine disposition workflow is how you uphold data minimization and keep the problem from recurring.

Escalate when sensitivity is high

If the data is especially sensitive (such as Social Security numbers, health, or financial records) or if you suspect it may have been improperly accessed, involve your privacy officer, legal, and security teams promptly. Frameworks like the NIST Privacy Framework treat minimizing unnecessary data as a core safeguard.

For related guidance, see the privacy and PII topic hub.