Application decommissioning data retention is the part of retiring an old system that decides what happens to its data: what you keep, for how long, where it lives once the application is gone, and how you destroy the rest. Get it right and the old system can be switched off without legal risk; get it wrong and you either keep paying for a dead application or lose records you were required to hold.
Quick answer: before you retire an application, list every type of record it holds, match each one to the retention rule that applies (tax, health, employment, contracts or your own policy), export what you must keep into a cheaper, searchable archive with access controls, prove you can retrieve it, and securely destroy the rest. Legal holds override every schedule, so check for them first.
Why does data retention decide when you can decommission an application?
Most old applications are kept running long after anyone uses them for one reason: nobody is sure whether the data inside can be deleted. The license, hosting and support bills continue, and so does the security risk of an unpatched system holding customer records. A retention plan turns that open question into a list of decisions, which is what lets the application decommissioning project finish.
Retention is also where decommissioning projects most often slip. Data owners have to agree on what each record type is, legal or compliance teams have to confirm the rules, and someone has to test that the archive actually answers the questions auditors and customers ask. Starting that work early is cheaper than pausing a shutdown halfway through.
How long do you have to keep data from a retired system?
There is no single number. Each kind of record carries its own rule, and the old application usually mixes several. A few common examples from primary sources show how much they differ:
| Record type | Rule | Source |
|---|---|---|
| Records supporting a federal tax return | Generally 3 years; 6 or 7 years in some situations; employment tax records at least 4 years | IRS |
| HIPAA security documentation | 6 years from creation or last effective date, whichever is later | 45 CFR 164.316 |
| Contracts and customer agreements | Set by your contracts, your lawyer and your own policy | Your legal team |
| Data under a legal hold | Keep until the hold is released, regardless of schedule | Your legal team |
The IRS explains that business records should generally be kept until the period of limitations for the related return runs out, with periods of 3, 6 and 7 years in different situations and at least 4 years for employment tax records (IRS). Organizations covered by HIPAA must keep their required security documentation for 6 years from its creation or the date it was last in effect, whichever is later (45 CFR 164.316).
These are examples, not a schedule for your business. Industry rules, state laws, contracts and privacy laws in the countries where your customers live can all add requirements. Have your lawyer or compliance lead confirm the list before anything is deleted.
What should you do with the data before you switch the application off?
- Inventory the data: every table, file store, attachment folder and log the application writes, plus copies in backups and reports.
- Classify each record type and assign its retention rule and owner.
- Check for legal holds and open disputes, and pause deletion for anything they cover.
- Decide the destination for each type: migrate it to the replacement system, move it to a read-only archive, or destroy it.
- Export and validate: compare record counts and sample records between the old system and the archive.
- Test retrieval: run the searches an auditor, customer or lawyer would actually request.
- Set access controls and an expiry date on the archive so data is deleted when its period ends.
- Securely destroy what you do not need to keep, including old disks and backups, and record what was destroyed and when.
The archive does not need the old application. In most retirements the data is exported to a format that will still open in ten years, such as CSV, JSON or PDF for documents, stored in a database or storage service you already pay for, and wrapped in a simple search screen for the few people who need it.
You are not keeping the old application; you are keeping the records it holds, in a form someone can still find.
