Most small teams have no answer to a simple question: how long do we keep a contact record we never closed? The default answer is forever, and that creates real costs. The CRM slows down, reports count people who left years ago, and privacy obligations grow with every stale record. A retention policy replaces the accidental answer with a deliberate one.
The policy does not need legal review to be useful. It needs a small number of clear rules that a trained virtual assistant can apply consistently, plus a named owner for the judgment calls. This guide builds a practical policy for a growing team that wants a cleaner CRM without a data-governance program.
Separate the record types before you write rules
Retention only makes sense per record type, because a contact, a company, an activity, and a marketing consent record have different lifecycles. Write your rules for four buckets:
- People, meaning contacts and leads.
- Companies, meaning accounts and their firmographic data.
- Activities, meaning emails, calls, notes, and meeting logs.
- Consents and legal records, meaning opt-ins, opt-outs, and agreement history.
Treating these separately prevents a common mistake: deleting a contact to reduce clutter while losing the consent evidence you need to prove why you stopped emailing them.
Choose a retention principle you can explain
The simplest defensible principle is "keep the record while it supports an active relationship, then archive or delete on a schedule." For a contact, that means keeping records that are in an open opportunity, an active customer relationship, or an active nurture path, and setting a clock on everything else.
Pick windows you can justify. A common small-team starting point: inactive marketing contacts after twenty-four months of no engagement, closed-lost opportunities after eighteen months, and raw purchased or event lists after twelve months unless someone opted in. These are starting points, not universal truths; adjust them to what your business can actually support and write down the reasoning so the policy survives a change of staff.
Regulatory frameworks differ by region and by how you market, so the policy should name the rules that apply to you and who to ask when they are unclear. The UK regulator, for example, publishes guidance on how long to keep personal data, which is a useful reference for the principle even if your market differs.
Define the four actions precisely
A policy fails when the vocabulary is fuzzy. Define each action so two people applying it reach the same result:
- Keep. The record is in scope for ongoing work and needs no change.
- Archive. The record leaves the working views and reports but stays recoverable for a defined period.
- Merge. The record duplicates an existing one and should be consolidated under the surviving record.
- Delete. The record has no purpose and no legal hold, and should be removed along with its activity history as permitted.
Write which action applies to which bucket and when. For example: a contact with no engagement for twenty-four months and no open opportunity is archived, then deleted twelve months later if still inactive. A contact with an opt-out is kept as a suppression record, not deleted, so you do not accidentally message them again.
Handle consent and suppression before deletion
Deletion is the riskiest action, because it can remove the very evidence that protects you. Before any delete, check three things: whether the contact has an open opportunity or support issue, whether they are a current customer with a contract, and whether the record carries a consent or suppression flag.
Suppression records are a special case. When someone opts out of marketing, keep the minimum data needed to honor that choice, such as the email address and a suppression flag, even if you delete the rest. Losing a suppression record is worse than keeping a little extra data, because it can lead to an unwanted message you promised not to send.
Automate the scheduled part, review the exceptions
The policy becomes reliable when the routine parts run on a schedule. Set a recurring view or workflow that surfaces records approaching their retention limit, and have the owner review that queue rather than hunting through the whole database. Automation handles selection; a person handles the edge cases.
Keep a short exception log for any record that is kept beyond its window. Record the reason and the owner. Exceptions are normal, especially for strategic accounts, but unexplained exceptions are how policy quietly dies. A one-line log entry every few weeks is enough.
Make the owner explicit and the review monthly
Name one owner for the policy, usually the same person who owns CRM hygiene. That person approves deletions at the margin and signs off on the monthly cleanup. A trained VA can run the queue, merge duplicates, apply archive rules, and prepare the deletion list; the owner reviews the list before it executes.
Separate the person who proposes a deletion from the person who approves it when the data is sensitive. This two-person check is cheap and prevents a well-meaning cleanup from removing a relationship the sales team still needs.
Communicate the policy to the whole team
A retention policy that only the ops owner knows will be violated by default. Put a short version where everyone sees it: what gets archived, what gets deleted, and what stays. Tell the sales team how to flag a record they want kept, such as an account they plan to revisit next year. When people know the rules and the exception path, they stop guarding the CRM defensively.
Review the policy once a year, or whenever your marketing rules or tools change. Retention windows that fit a two-person startup can be too aggressive or too loose for a team with a real sales motion, and the policy should move with the business.
A clean CRM is a byproduct of clear rules, not heroic cleanup weekends. If you would rather have a trained operator run the recurring hygiene and retention queue inside your CRM, see how our CRM upkeep support works, or book a free consultation and bring your current record counts.
