Archive documents and destroy them on schedule

When to use

Once a year, or when the archive grows past "a few folders and a drawer". Not for turning paper into files — use documents.scan-paper first, then classify the result here. Not for deciding what personal data may be kept in a customer record — that is company.gdpr-register; this playbook stores and destroys, it does not define processing purposes.

Before you start

• The owner has confirmed who signs off destruction (usually the board member or owner-manager).
• ⚠ verify current retention periods for accounting, tax, employment and contract documents under Latvian
• Physical documents are either already scanned (documents.scan-paper) or their location is known.

What a run requires3

The trail9 steps

1. S1

   Inventory what existsagent

   List document types actually held: contracts, invoices, payroll, board minutes, applications, e-mail archives, paper originals.

   Done when the inventory lists every type with roughly how many items and where they live (which folder, which box, which system).

2. S2

   Classify into retention groupsagent

   Assign each type a group with a period and a source: e.g. accounting documents — period per Accounting Law (⚠ verify the exact figure on likumi.lv); employment documents — per labour law (⚠ verify); personal data — shortest period that serves the stated purpose.

   Done when every type in S1 has a group, a period and a named source — or is flagged "unknown" for S3.

3. S3

   Approve the scheduleownerneeds approval · owner

   Approval · S3 · owner — the run stops until a named person records the decision

   Present the schedule; resolve every "unknown" — the owner either finds a basis or decides a company rule and accepts the risk in writing.

   Done when the schedule carries the owner's name and date and no type is left without a period.

4. S4

   Put documents into the structureagent

   Move digital files into folders named by group and year; label physical boxes the same way; record each box's contents in the documents module.

   Done when a stranger can find any document from the index in under a minute.

5. S5

   Set the destruction date on every itemagent

   From the group period and the document's year, write the earliest lawful destruction date on the item or its index row.

   Done when every item in the archive shows a date, not just a group.

6. S6

   Calendar the reviewagent

   Create the yearly task (bc tasks add) for next year's review, linked to this playbook, owner as watcher.

   Done when the task exists with a due date and the owner is on it.

7. S7

   Build the yearly destruction listagent

   At review time, list everything whose destruction date has passed, excluding anything under dispute, audit or an open data-subject request.

   Done when the list shows item, date, group, and a reason line for every exclusion.

8. S8

   Approve destructionownerneeds approval · ownerirreversible

   Approval · S8 · owner — the run stops until a named person records the decision

   Irreversible · S8 — an agent never closes it alone

   Walk the owner through the list; the owner approves item by item or batch.

   Done when the approval — who, when, which items — is recorded next to the list.

   ⛔ Destruction is permanent. If the owner hesitates on an item, it stays for another year; a "maybe" is never a yes.

9. S9

   Destroy and recordagent

   Destroy approved items: delete digital copies from all locations including backups per the backup policy, cross-shred or hand paper to a certified destruction service (a paid third party — only items approved in S8). Record what was destroyed, how, when, and by whom.

   Done when the destruction record exists and the items no longer appear in the index.

Checks — how we know it worked

• Pick five items at random from the archive: each shows group, period, source and destruction date.
• Pick five items from last year's destruction list: each is gone from the index and has a destruction record.
• No document type in the inventory lacks a period.
• Next year's review task exists and is assigned.

If it goes wrong

What each step leaves behind

1. S1the inventory lists every type with roughly how many items and where they live (which folder, which box, which system).
2. S2every type in S1 has a group, a period and a named source — or is flagged "unknown" for S3.
3. S3the schedule carries the owner's name and date and no type is left without a period.
4. S4a stranger can find any document from the index in under a minute.
5. S5every item in the archive shows a date, not just a group.
6. S6the task exists with a due date and the owner is on it.
7. S7the list shows item, date, group, and a reason line for every exclusion.
8. S8the approval — who, when, which items — is recorded next to the list.
9. S9the destruction record exists and the items no longer appear in the index.

Evidence to keep

The inventory · the approved schedule with sources and the owner's sign-off · per-year destruction list · destruction records (what, how, when, by whom) · the calendar task id · exclusions with reasons.

How this playbook improves

After every 3 yearly runs ask: what share of items had a destruction date before the review (not during it)? How many items were deferred with "maybe" — a sign the schedule's periods are wrong? Did any document type appear in S1 that the schedule missed? A new version changes the schedule-building steps or adds the missing type, and says so in its change note.