We found boxes of records that are years past their retention date — can we just shred them now?

The short answer is: not yet. Passing a retention date makes records eligible for destruction, but it does not authorize it. A retention schedule sets the minimum time you must keep a record. Reaching that point only means the clock has run out — several other conditions still have to be satisfied before anything can be shredded.

Why “past retention” is not enough

A retention period is one input into a disposition decision, not the whole decision. Before destroying anything, you generally need to confirm:

• No legal hold applies. If the records are subject to litigation, an audit, an investigation, or a regulatory inquiry — or could reasonably be anticipated to be — a hold suspends destruction regardless of the schedule. Destroying records under hold can carry serious consequences.
• The schedule is current and correct. Boxes that sat for years may have been scheduled under an outdated policy, or never properly classified. A record’s true retention may be longer than the box label suggests.
• Disposition is properly authorized. Most programs require a documented review and sign-off before destruction, often from records management plus legal or program owners.
• Other obligations don’t extend the period. Tax, employment, privacy, contractual, or program-specific requirements can require longer retention than a general schedule implies.

A safe sequence to follow

1. Quarantine the boxes and do not destroy anything yet.
2. Inventory the contents — record types, date ranges, originating office.
3. Check for active holds with legal/compliance before proceeding.
4. Verify retention against your current, approved schedule for each record type.
5. Obtain authorization and document the disposition decision.
6. Destroy securely using a method appropriate to the sensitivity (for example, confidential shredding for personal or restricted data), and keep a certificate or log of what was destroyed and when.

Why documentation matters

Defensible destruction depends on showing that records were disposed of in the normal course of business, under an approved schedule, with no hold in place. That audit trail is what protects the organization later. Found, undocumented boxes are exactly the situation where teams skip steps — so slow down and document.

For foundational concepts on schedules, holds, and disposition, see the fundamentals topic hub.