A batch of closed files is boxed up for shredding when someone notices that two boxes contain discovery materials still under an investigation hold. The retention period has passed, but the records team needs to set those boxes aside, and IT needs to preserve copies on the shared drive. The rest of the batch can go once it’s been cleared for pickup.
That’s the kind of decision a law firm data destruction policy should help staff make. Before the next file purge or equipment retirement, the firm should know which records can go, who approves their release, how they’ll be destroyed, and what paperwork will show the job was completed.
What to include in a law firm data destruction policy
1. Where the records live and who handles them
A single matter can leave records in several places. The paper file may be in off-site storage, while email, discovery materials, and working copies sit in a document management system, a cloud workspace, or an e-discovery platform. The policy should account for what’s held in backups, on laptops and copiers, at remote offices, and by outside providers. It should also cover firm records such as trust accounting, billing, and HR files.
Records staff can manage paper files while IT handles electronic records and devices. For each batch, the policy should spell out who prepares the disposal list, which attorney approves it, and who verifies completion. Each role, including the policy owner, needs a backup so the process can continue when someone is out.
2. How long each type of record stays on file
A law firm document retention policy is easier to apply when staff can look up the rule for the type of record in front of them. A schedule can show when the retention period starts and whether the firm needs to return a document or give notice before destroying it. The authority for each entry may come from professional conduct or privacy rules, court or protective orders, engagement terms, or a client’s outside counsel guidelines. Counsel can resolve conflicts, and separate schedules may be needed when requirements differ by jurisdiction.
| Record category | Authority | Retention period | When the clock starts | Return, notice, or destruction conditions |
| [Record type] | [Rule, order, or agreement] | [Period] | [Trigger event] | [Conditions to clear] |
Under Massachusetts Rule 1.15A, the default retention period for ordinary client files is generally six years after the matter ends or the representation terminates. The rule addresses file transfers and written alternatives, with separate provisions for minors, criminal and delinquency matters, and intrinsically valuable documents. Trust accounting and firm business records need separate schedules. The policy should also make clear who checks for client requests, handles any required return or transfer of originals, and records when that work is complete. Massachusetts Rule 1.15A · Law firm guide to records, holds, and secure disposal · Accounting firm guide to financial and tax records
3. What can put disposal on hold
Records and IT should check for holds before files are staged or released. If a hold applies, Records can pull the affected boxes while IT preserves electronic copies, including those held by providers. That may mean pausing automatic deletion or backup rotation. Even if the hold register is blank, staff should pause disposal and consult counsel about uncertain matches or pending or anticipated claims, investigations, or proceedings that may require preservation.
In Massachusetts, Rule 1.15A(e) also bars destruction for ten years after unclaimed or unidentified funds potentially linked to the file are transferred to the IOLTA Committee under Rule 1.15(i). Massachusetts Rule 1.15A(e)
The policy should identify who can lift a hold in writing. Once it’s lifted, staff still need to check the retention schedule and confirm that no other holds apply before releasing the records. A short approval record can capture those checks for each batch.
Batch ID [ ] · Retention schedule entry [ ] · Hold check date and result [ ] · Approving attorney [ ] · Approval date [ ]
4. How paper, digital records, and devices are destroyed
A box of paper files, a set of cloud records, and a retired laptop need different legal data destruction procedures. For each, the policy should explain how staff handle the material from approval through disposal.
- Paper. Locked consoles give staff a place for confidential discards and cleared files. The law firm shredding policy should explain which files need written approval before they go in. Where Massachusetts’ disposal law applies, shredding must make personal information impracticable to read or reconstruct. Massachusetts General Laws c. 93I, § 2
- Digital records. A record approved for deletion may still have copies in a cloud workspace or a backup. IT’s procedures should cover deletion from active systems, how cloud providers handle it, and when remaining copies expire from backups. If a backup is restored, IT needs to reapply current holds and disposition rules before putting the data back into use.
- Physical media. An inventory of retired hard drives, SSDs, removable media, and embedded storage gives IT a way to track each item through disposal. The type of media and sensitivity of the data guide the choice of sanitization method, and IT should verify that it was completed. Where physical destruction is required, the policy should specify the method for each media type and explain how staff match the completed job to the asset inventory. NIST SP 800-88 Rev. 2
5. What to check before hiring a destruction vendor
A firm can require NAID AAA Certification, a voluntary third-party certification, when hiring a shredding or media destruction vendor. When reviewing a provider, the firm can use i-SIGMA’s directory to check that the certification is current and that the endorsements cover the facility or mobile service and each type of media the firm plans to send.
The contract is where the firm and vendor agree on how the handoff will work. It should spell out how materials are protected in transit, what records change hands at pickup, how confidentiality is maintained, and what controls apply if the vendor uses a subcontractor. The agreement should also set deadlines for destruction and incident reporting. Where Massachusetts’ personal-information disposal law applies, the firm should require vendor safeguards during collection, transportation, and disposal. Massachusetts General Laws c. 93I, § 2
6. How the firm confirms the job is complete
After destruction, someone at the firm needs to match the vendor’s records to what left the office. The Certificate of Destruction should identify the provider, job number, material and quantity, actual destruction date and location, method, and authorized signoff. It belongs with the firm’s approval, pickup record, and any box manifest or device serial number log. If a drive appears on the pickup list but is missing from the destruction log, the job file should show how the discrepancy was resolved before it’s closed. Certificates of Destruction and chain-of-custody records
The policy should say who makes that final check, who can access the job file, and how long the firm keeps it. Where practical, matter numbers or asset IDs can identify what was destroyed without adding client names to the job file.
Put the policy into practice
A trial run with one batch of closed files or retired drives can reveal where staff are waiting for approval or where the paperwork is missing a detail the firm needs to close out the job. Those gaps are easier to fix before a larger purge. Once the policy is in use, an annual review and a fresh look when rules, client terms, or systems change can help keep it in step with how the firm handles records.
We can help set up recurring shredding, collect archive boxes you’ve cleared for disposal, or destroy retired hard drives. Contact us to talk through pickup and the records your firm needs for each job.