Old Files, New Liability: The Client Data Berks and Lancaster Businesses Keep Too Long

For many small businesses, the default data-retention policy is no policy at all: keep every file, email, scan and export indefinitely. It can feel safer than deleting something important. But retaining information without a defined business or legal reason creates a growing pool of data to protect, and a larger potential impact if that data is exposed.

For businesses in Berks County, Reading, Wyomissing and Lancaster, the right question is not simply, “How long do we have to keep old client and employee data?” It is: What do we need to retain, why do we need it, where is it, who can access it, and when should it be securely removed?

There is no single retention period that applies to every record or every business. Requirements vary by record type, industry, contract and circumstance. The business-risk answer is to identify what you hold, quantify the impact of keeping it, mitigate unnecessary exposure and monitor the policy over time.

Keeping everything increases the potential impact of a breach

Old data still carries risk. A forgotten folder may contain personal information, account details, employee records or confidential client material. If that information is copied into a cloud drive, archived mailbox, old laptop or backup, it may remain accessible long after its original purpose has passed.

The more sensitive information an organization retains, the more it may have to investigate, protect and potentially notify people about after an incident. Data that is no longer needed can also complicate a response: teams must determine what was exposed, whose information was involved, and whether a contract or law applies.

The Verizon 2024 Data Breach Investigations Report found that a human element was involved in 68% of breaches in its dataset. That figure is not a measure of human error alone, but it underscores why practical controls matter: people need clear rules for handling, sharing and disposing of information.

The principle is straightforward: you cannot expose data you no longer hold, provided it is not still sitting in another location, such as an unexpired backup or an employee’s downloaded copy.

Start with five risk questions

Before deleting anything, get a clear picture of what the business actually keeps. For each major category of information, ask:

1. What do we hold? Identify client files, employee records, invoices, scanned documents, email archives, exports and backups.
2. Where is it stored? Include paper files, shared folders, business applications, cloud storage, local devices and third-party systems.
3. Who can reach it? Check whether access is limited to people with a current business need, including former employees or outside providers.
4. Why must we keep it? Identify a specific legal requirement, contract, tax or accounting purpose, active business need, or reasonably anticipated dispute.
5. What would its loss or exposure cost us? Consider operational disruption, investigation, legal advice, customer communications, contractual consequences and reputational harm.

These questions help turn “we might need it someday” into a decision that leadership can assess. If nobody can explain the purpose of a file, that is a signal to review it, not an instruction to delete it immediately.

A practical retention starting point

The framework below can help small businesses start organizing their records this month. It is a planning baseline, not legal advice or a universal schedule. Confirm requirements with qualified legal and tax professionals, especially if your business operates in a regulated industry or has specific client contracts.

Record category	Useful starting point
Tax and payroll records	The IRS says employment-tax records must generally be kept for at least four years after filing the fourth-quarter return for the year. Certain records, including documentation for some tax credits, may require longer retention. Confirm the period for other tax and accounting records with your CPA.
Client files	Keep what is needed to perform the work, administer the relationship, satisfy a contract, support accounting or resolve a dispute. Set a review date tied to the contract or business purpose rather than retaining every client file forever.
Former-employee records	Separate payroll, benefits, medical, hiring and general personnel records; they may have different requirements. EEOC rules generally require covered employment records to be retained for at least one year, with a specific rule for involuntary termination records. A charge, lawsuit or other hold can extend retention.
Email archives	Apply the same schedule used for the information inside the email. Preserve messages that document contracts, approvals, transactions, complaints or decisions when required; do not treat every mailbox as a permanent archive by default.

The IRS employment tax recordkeeping guidance and EEOC recordkeeping requirements are useful starting references. They do not cover every record type or business-specific obligation. A lawyer or CPA can help establish the schedule that fits your organization.

Make a data inventory before launching a deletion project

A large, rushed cleanup can create its own risk. A file may be subject to an audit, contract clause, active complaint or legal hold. Start with an inventory instead.

Choose a manageable scope, such as one shared drive, one department or one category of former-employee records. For each location, record:

• The type of information and the business owner responsible for it
• Where it is stored, including paper files and third-party services
• Who has access, and whether that access is still appropriate
• The business or legal reason for keeping it
• The date it should be reviewed or removed
• Any exception, such as a legal hold, audit or contractual requirement

This inventory does not need to begin as a complex software project. A controlled spreadsheet can be enough to establish accountability and identify the highest-risk areas. Start with records that combine high sensitivity, broad access and no clear retention reason.

Turn the inventory into a managed risk process

Once the first inventory is complete, use it to guide four connected decisions:

Identify the risk. Find information that is sensitive, duplicated, difficult to locate or accessible to people who no longer need it.

Quantify the impact. Consider what a breach, loss or inability to produce a required record could mean for revenue, operations, customer relationships and legal obligations.

Mitigate the exposure. Limit access, reduce unnecessary copies, establish approved retention periods, and document how records will be disposed of. Make sure backups have defined retention too; deleting a file from its original location may not remove it from backup systems right away.

Monitor the policy. Assign an owner, review the inventory periodically and update the schedule when the business changes, a contract changes or a new requirement applies. Routine deletion should pause when litigation, an audit, an investigation or another preservation obligation is anticipated.

The goal is not to delete as much as possible. It is to keep what the business can justify, protect it for as long as it is needed, and remove it responsibly when that need ends.

For more practical guidance, visit the B&R Computers Resources Hub. Business leaders can also use the Cybersecurity Threat Briefing as a next step for understanding current risks and how they affect business decisions.

The first step is visibility

Old client files, departed-employee records, scanned invoices and long-forgotten exports are not automatically liabilities. They become harder to manage when no one knows what exists, where it lives, why it is being kept or who can access it.

For businesses across Berks and Lancaster counties, a documented inventory is a practical first move toward better control. B&R Computers approaches this as a business-risk process, not a mass deletion exercise: identify exposure, understand the potential impact, prioritize mitigation and monitor the results.

Request a free Business Review to discuss where retained data may be adding avoidable risk and what to prioritize next.