Customer Data Retention: What to Keep and What to Destroy

Why this matters

Every record a shop keeps is something that can be lost, stolen or demanded. A filing cabinet of old job tickets with card numbers scribbled on them, a retired office computer in the storeroom with nine years of customer exports on it, an inbox holding every scanned driver's license from every truck rental: none of it earns anything, and all of it counts the day a breach happens, because breach notice obligations are counted per person whose data was exposed. The habit that fixes this is called data minimization: hold what you need, for as long as you need it, and destroy the rest on a schedule. It is the cheapest security control a small shop has, because the data you no longer hold cannot leak.

Sort everything into three bins first

Before setting periods, decide why each kind of record exists. Each answer gives a different clock.

• You need it to operate. Customer name, service address, phone, email, equipment installed, service history, open invoices. This is the working file. Its clock is the customer relationship plus a tail for warranty and disputes.
• The law says to keep it. Tax records, payroll, employment eligibility, some trade and safety records. Its clock is set by statute, and it starts from a specific event (the filing date, the termination date), not from when the record was made.
• Nobody needs it. Full card numbers, card security codes, copies of customers' IDs taken "just in case", old exports, duplicate spreadsheets, an ex-employee's personal files. Its clock is zero. Destroy it now and stop creating it.

The third bin is usually the largest by risk and the smallest by value, and it is where the first purge pays off.

Set a period for each record type

The schedule below is a starting point for a residential service shop. Federal periods are stated with their source; anything that rests on state law is marked so, because that layer routinely sets a longer period than the federal one and your state's rule wins where it does. This is not legal advice: confirm the state-layer rows with your accountant or attorney, who will know your state's figures.

Two judgment calls in that table deserve their reasoning.

Why the customer file has a tail but not forever. A customer who has not called in five years is not a customer, but a furnace you installed six years ago may still be under the manufacturer's warranty, and the install record is what proves the work. So the rule is not "delete inactive customers," it is "trim inactive customers to what defends a past job": name, service address, what was installed, when, the invoice. Phone numbers, emails, notes and payment details go.

Why install records follow the state period, not the IRS one. The IRS period protects you from the tax authority. The contract and repose periods protect you from a homeowner, or the homeowner's insurer, who says your work caused a loss. Those periods are set by your state, and for construction-type work they commonly reach years beyond the tax period. Keeping install records only three years because the IRS says three is the common mistake.

Find where the data actually lives

Records hide in more places than the business software. List each location once:

• The business system (customers, jobs, invoices, notes, attachments).
• Email inboxes, including the shared office inbox and ex-employees' mailboxes that were kept "in case."
• Shared drives and the office computer's desktop and downloads folder.
• Phones and tablets: photos of customer IDs, card numbers in text messages, screenshots.
• Paper: job tickets, carbon-copy invoices, sign-in sheets, files in the truck.
• Retired equipment: old computers, external drives, the copier (many store every page scanned on an internal disk), old phones in a drawer.
• Exports: spreadsheets someone pulled for a mailing and never deleted.

The last two are where the forgotten data sits, because nobody thinks of them as storage.

Destroy it properly

Destruction that can be undone is not destruction. Match the method to the medium.

• Paper: a cross-cut or micro-cut shredder, not a strip-cut one, which leaves strips that can be reassembled. For large volumes, a shredding service that issues a certificate of destruction. Where records include consumer report information (background checks, motor vehicle reports on drivers), the FTC Disposal Rule at 16 CFR 682 requires reasonable measures such as burning, pulverizing or shredding so it cannot be read or reconstructed, and many states add their own disposal law covering personal information generally.
• Files on a working computer or cloud service: delete, then empty the trash or recycle bin, then check the service's own "recently deleted" holding area, which often keeps files for 30 days or more.
• A retired computer, drive or phone: a factory reset on a modern phone with storage encryption on is effective. For a computer or external drive, use the drive's secure-erase function, or physically destroy it (a drive-shredding service, or drilling through the platters of an older spinning disk). NIST SP 800-88 is the reference for media sanitization if your IT person wants a standard. Hazard: drilling a drive throws metal fragments and the platters of some drives are glass; wear eye protection and gloves and clamp the drive, never hold it by hand. Do not attempt to open or puncture a phone or laptop battery, which can catch fire; leave battery devices to an electronics recycler that certifies data destruction.
• The copier: ask the leasing company or the service tech to wipe or remove the internal disk before it leaves the building.

Record every destruction: what, how much, which method, date, who. A one-line log entry is enough, and it is the proof that the schedule is real.

Worked example: an eighteen-person HVAC shop's first purge

The shop has been in business eleven years. It has a business system holding 14,200 customer records, three filing cabinets of paper job folders back to year one, a retired office computer in the storeroom, and a shared inbox.

Finding the third bin. In the paper folders from years one through four, before the shop took card payments through its software, phone-booked jobs have the customer's full card number and security code written on the ticket. The office manager samples 50 folders and finds card details in 19, about 38 percent. On the retired computer, a desktop folder holds four customer exports from different years, the largest with 11,900 rows including phone, email and address. The shared inbox holds about 300 emailed photos of customer IDs from a period when the shop rented equipment to homeowners.

Applying the schedule.

• Paper with card numbers: no reason to keep, ever. All folders from years one through four go to a shredding service, after pulling install records for any equipment still plausibly under warranty. That pull takes one person most of two days and produces one thin box.
• The retired computer: nothing on it is the only copy, because the business system holds the live data. The drive is secure-erased, then the machine goes to a certified recycler.
• The ID photos: deleted from the inbox, then from its deleted-items folder.
• The customer file: of 14,200 records, 8,600 have had no job in the past five years. Those are trimmed to name, address, equipment and install date. Phone, email and notes are removed. 5,600 active records stay whole.

What it changed. Before the purge, a theft of the storeroom computer exposed contact details for up to 11,900 people from the largest export alone, and a theft of the filing cabinets exposed card data for a share of every phone booking over four years, about 38 percent of folders in the sample. After it, the computer is gone, the card data is gone, and a full breach of the business system exposes contact details for 5,600 people and only name and address for the rest. That is the number the shop would have to count in a breach notice, and the number its cyber insurer asks for on the application. See related: Handling a Data Breach Notification Obligation.

Where it could have gone wrong. The shop nearly shredded the install records with everything else. Two weeks after the purge, a homeowner's insurer contacted the shop about a water-damage claim blamed on a condensate line the shop installed nine years earlier. The pulled install record, with the date, the equipment and the tech's notes, is what the shop's insurer used to respond. Shredding by year rather than by record type would have destroyed it.

What would change the answer. A shop in a state with a longer contract limitations period, or one doing larger construction-type installs, would keep more install records for longer. A shop that finances work in-house, or extends credit to customers, may sit under additional federal rules for financial records and should ask its accountant before purging any of them.

Keep it running

A purge once is a project; a schedule is a habit. Pick one day a year, the same day as the annual security review if the shop runs one, and run the schedule: trim inactive customers, shred paper past its period, delete stray exports, and check that no new third-bin data has crept in (card numbers in notes fields, ID photos in texts). Put the destruction log entries with that year's review record. See related: The Annual Security Review SOP.

References

• IRS, "How long should I keep records?" (irs.gov), for the 3-year, 6-year and employment tax periods
• FLSA recordkeeping, 29 CFR 516.5 and 516.6; FTC Disposal Rule, 16 CFR Part 682
• NIST SP 800-88, Guidelines for Media Sanitization
• PCI Security Standards Council, guidance on storing cardholder data (pcisecuritystandards.org)
• See related: PCI Compliance Explained for a Small Shop