Most companies don’t set out to retain every file forever. It happens through default settings, unclear ownership, and the understandable instinct that deleting something is riskier than keeping it. A request from HR for a policy from 15 years ago can expose how far that default has drifted.
Consider a company with fewer than 200 employees. Their M365 backup environment has grown to 19TB because every version of every backup is retained indefinitely. On the surface, this looks like a storage problem. In practice, it’s a governance problem.
The first operational issue is cost. Storage is relatively inexpensive until retention compounds across mailboxes, SharePoint sites, Teams data, and multiple restore points. But cost is rarely the main risk. The deeper problems include slower recovery when something actually needs to be restored, expanded legal exposure during discovery, and no clear answer when regulators or auditors ask what the retention standard is.
A second issue is that ‘keep everything’ is not a defensible policy. It sounds cautious, but it creates an unmanaged data environment. Without classification, disposition schedules, and tiered archiving, the organization cannot consistently explain why certain records exist, who owns them, or when they can be removed. That ambiguity becomes a liability during litigation or compliance review.
The operational fix is not simply deleting data. It starts with defining retention requirements by record type—employment records, financial documents, contracts, operational communications. Legal and HR typically own the compliance rationale. Finance weighs in on cost and audit needs. IT translates those requirements into backup versioning limits, archive tiers, and automated retention labels.
In many organizations, the first practical step is a retention workshop. It rarely requires a large technology investment. It requires someone with authority to make the policy real, and a system to apply it consistently. Once a schedule is in place, backup volume stops growing by default and starts reflecting actual business need.
The broader point is that retention is not an IT decision that gets handed down. It’s an operational discipline. When HR has to ask for a policy from 15 years ago, it usually means that discipline was never formally established. That’s a correctable problem—but only if ownership is assigned and the policy is treated as a living operational control rather than a one-time cleanup.
