Most nonprofits keep everything. The donor who gave once in 2011 and moved away, the email list you bought for a campaign that ended years ago, the intake files for clients you served a decade back. Storage is cheap and deleting feels risky, so it all piles up. Then one day you are asked whether you still hold sensitive information about people you no longer serve, and you realize you have no idea what is in there or why.
Keeping everything is not the safe choice it feels like. Old records you do not need are a liability, especially when they contain personal information about the people you serve. At the same time, deleting the wrong thing can cause real problems, from breaking a funder's requirement to losing history you will want later. The answer is a simple framework for what to keep, what to archive, and what to delete, applied on purpose rather than by default.
Before going further, one important note. This is a practical guide, not legal advice. Retention requirements vary by state, by funder, and by the kind of data you hold, and some records carry legal obligations. Use this framework to get organized, then confirm the specifics with an attorney who knows nonprofit and your jurisdiction before you delete anything you are unsure about.
Keep what is active or required
The keep pile is for records you use now or are obligated to hold. Active donor and constituent records belong here, including the giving history of anyone who still gives or might reasonably give again. That history is genuinely valuable, and a lapsed donor from two years ago is a keep, not a delete.
Records you are required to retain also belong here regardless of whether you use them. Financial records, tax documents, and anything a grant agreement or your state requires you to hold for a set period stay until that period passes. Your finance colleague and your funders' agreements will tell you what those periods are. When a requirement applies, it overrides everything else in this framework.
Archive what you might need but do not use
Archiving is the middle path, and it is the one most nonprofits skip. An archive is for records you are not actively using but are not ready to delete, moved out of your working systems into clearly labeled, secure storage.
Old program data is a good candidate. The client outcomes from five years ago may matter for a longitudinal report someday, but they do not belong in your live database cluttering your active work. Past event records, closed campaign details, and the giving history of long-lapsed donors can all move to an archive where they are safe and out of the way.
The key to archiving is that it is deliberate and documented. You know what is in the archive, where it lives, and how it is protected. An archive is not a folder called "old stuff" on someone's desktop. It is a defined place with the same security as your live data, especially if it holds anything personal.
Delete what carries risk and no value
The delete pile is the one that takes courage, and it is where the real risk reduction happens. Some records offer you nothing and expose you to harm if they leak. Those should go, once you have confirmed no retention rule requires them.
Sensitive personal information about people you no longer serve is the clearest example. Intake details, screening records, health or financial information collected for a program someone left years ago. If you have no active need and no obligation to keep it, holding it only creates risk. The same goes for old purchased or borrowed email lists, which you likely have no consent to keep using and no reason to store.
When you delete, delete properly. Removing a row from a database or dragging a file to the trash is not always enough for sensitive data. Make sure deleted records are actually gone from backups and exports too, and write down what you deleted and when, so you have a record of acting responsibly.
Make it a routine, not a one-time purge
The organizations that handle this well do not do a heroic cleanup once and then let everything pile up again. They set a simple retention schedule, a short document that says how long each type of record is kept, when it moves to archive, and when it is deleted. Then they review it once a year.
A retention schedule turns an overwhelming question into a routine one. Instead of staring at fifteen years of accumulated data and feeling paralyzed, you follow the schedule: this year's expired records get archived or deleted according to the rules you already set. It also protects you, because a documented, consistently applied retention practice is exactly what a funder or auditor wants to see.
Start small. Pick one category, old email lists or intake files from closed programs, decide the rule with your attorney's input, and act on it. Then add the next category next quarter. A little at a time turns a decade of digital hoarding into a database that holds what you need and nothing that puts your people at risk.
If you want help building a retention schedule and safely cleaning out what you no longer need, that is work we do with nonprofits regularly. You are welcome to book a free discovery call to talk through your situation.