Data Retention, Access Control, and Encryption for Firms

Data retention, access control, and encryption sound like three chapters from a compliance manual, and they're really three answers to one question: how bad does it get when something goes wrong? Keep less data, and there's less to steal. Control who can open what, and a stolen password reaches less. Encrypt everything, and whatever does get taken is unreadable. Every serious client-data program is those three habits with paperwork attached, and a small firm can run all three without a security department.

Keep less

Every file you store is a small liability with no expiration date. If client data from 2015 leaks in 2026, you're notifying those clients and managing that fallout, even though nobody at the firm has thought about those files in a decade. Firms that keep everything forever "just in case" are buying risk and paying storage fees for the privilege.

The fix is a retention policy that fits on two pages. Sort your data into four buckets: active engagement files, completed work still inside its legally required retention period, expired data past that period, and the small set of permanent firm records. Your regulator sets the minimum retention period. Your policy should set a maximum too, because past the legal requirement, old data is pure downside.

Then dispose like you mean it. Dragging files to the trash isn't disposal; the data stays recoverable until it's overwritten. Use proper wiping tools for drives, cross-cut shredding for paper, and certified destruction for retired hardware. That closet of dead laptops in most offices is a breach waiting for a burglary. (Nobody inventories the closet, by the way. Attackers and auditors both know this.)

Decide who can open what

Access control is one principle applied with discipline: each person gets the access their job requires, and nothing extra. The seasonal preparer working individual returns doesn't need the corporate client archive. The receptionist doesn't need the document management system. In the law firm version of this problem, matter-level access also protects privilege, which raises the stakes considerably.

The manageable way to do this is roles, not individuals. Define a handful of roles (partner, senior, staff, admin, seasonal), attach permissions to each role in every system, and assign people to roles. When someone's job changes, you change one assignment instead of hunting through nine platforms.

Two habits keep it honest. First, review access quarterly, because permissions only ever accumulate. People collect access from old projects and temporary favors, and nobody ever asks for less. Second, when someone leaves, every account dies the same day. Months-old live credentials belonging to ex-employees are one of the most common findings in security assessments, and among the most dangerous.

Admin accounts deserve their own paragraph. Separate them from daily-use accounts, keep the count low, log what they do, and protect them with the strongest MFA you have. Admin credentials are what attackers hunt for once they're inside, because admin is where a foothold becomes a takeover.

Encrypt everything, then guard the keys

Encryption is the layer that holds when the other two fail. Data gets stolen; encrypted data gets stolen and stays useless.

At rest: full-disk encryption on every computer, which is free and built in (BitLocker on Windows, FileVault on Mac), and turns a stolen laptop back into a hardware loss instead of a client notification. Encryption enabled on servers and in your cloud storage settings, where it's often available but not switched on.

In transit: modern TLS for everything, and secure portals instead of email for the genuinely sensitive documents. An emailed tax return travels further and lives longer than anyone intends.

And the keys. Encryption is only as strong as key custody, so keep keys separate from the data they protect, document who holds them, and write down the recovery process, because the other way encryption fails is a firm locking itself out. Sorting out which of these controls your firm already has, half-has, or only believes it has is where our client data encryption work usually starts, and the honest inventory is regularly a surprise.

How the three cover for each other

Retention shrinks the target. Access control limits how much of the target one stolen credential can reach. Encryption makes whatever's reached unreadable. A firm running all three can have a laptop stolen, an account phished, or an old archive probed, and shrug where another firm sends letters.

There's a compliance dividend too. When auditors, insurers, or the IRS's Publication 4557 expectations come calling, these three areas are where they look first, and they're where the most common compliance gaps in professional firms live. Doing this work once quietly closes several findings before anyone writes them up.

A realistic starting sequence

Start with the inventory, even though it's the tedious part. What data exists, where it lives, who can currently touch it. Firms are reliably shocked by what turns up: forgotten shares, a decade of email archives, the ex-bookkeeper's still-active login.

Then set retention periods and actually delete the expired backlog. Move access to roles and run the first quarterly review. Switch on the built-in encryption everywhere it's dormant. Document each step as you go, because a control you can't demonstrate doesn't exist as far as insurers and regulators are concerned.

None of this is glamorous. That's rather the point: the boring controls are the ones that decide outcomes. Slot these steps into the larger cybersecurity checklist for firms so they don't get crowded out by shinier projects, and see our cybersecurity guide for firms for how the three habits fit the bigger defensive picture.