Free Template for Dealers
Data Retention Policy Template for Dealerships
A fill-in policy and retention schedule for deal jackets, service records, email, recordings, HR files and backups, including the copies your vendors keep.
Or download the template as an editable Word file or a printable PDF.
A data retention policy template for dealerships is a fill-in document that lists every type of record the store holds, who owns it, how long it’s kept, where each copy lives, including at vendors, and how it’s destroyed.
Last updated: November 10, 2026
Know What You Hold Before You Decide How Long to Keep It
The FTC Safeguards Rule names it without defining it. Its disposal provision, 16 CFR 314.4(c)(6), tells you to “periodically review your data retention policy to minimize the unnecessary retention of data.” Setting the clock is the easy part. Finding every copy is the work.
Retention is a vendor question as much as a filing one: how long each vendor keeps your data, and how that data is disposed of. Row 1 of the schedule below lists the places a deal’s copies may sit, from the file room and the DMS to lender portals and a scanning or e-contracting vendor, and our cybersecurity for dealerships page covers the controls around all of them. This template puts every copy on one schedule.
One rule before you start. This template is not legal advice, and it leaves every retention period blank on purpose, so set yours with your attorney and outside CPA.
Section 3
What Should a Dealership Data Retention Schedule Cover?
Every kind of record the store keeps, each with an owner, a period you set with counsel, every place a copy lives and the way it’s destroyed. Start with the seven below and add your own. The vendor column is the one to fill in slowly, one phone call at a time.
| The record | Where copies live | How long, and who decides | How it’s destroyed |
|---|---|---|---|
| Deal jackets and credit applications | The paper jacket in [file room], the DMS, lender portals and [scanning or e-contracting vendor]. | [F&I director], with counsel. If the store acts as a creditor, Regulation B sets at least 25 months for consumer credit applications. | Cross-cut shredding for paper. Deletion in each system and at each vendor, confirmed in writing. |
| Service repair orders | The DMS, [service scheduling or texting vendor] and printed copies in [service office]. | [Service director], with counsel. Ask whether your manufacturer’s warranty terms set a period. | Shredding for paper. A purge in the DMS, run the way your DMS provider tells you. |
| Microsoft 365 or [email system], mailboxes of people who’ve left, and [archive vendor]. | [IT or operations manager], with counsel. A legal hold overrides the period. | A retention setting that deletes on schedule. Former employees’ mailboxes go when their period ends. | |
| Call recordings | [Phone system vendor]’s cloud and [BDC or call tracking vendor]. | [Sales or BDC manager], with counsel. Write the number of days down. | An auto-delete setting at each vendor, confirmed in writing. |
| Security camera video | The recorder on site and [camera vendor]’s cloud. | [General manager], with counsel. Footage tied to an open claim is held. | The recorder overwrites on schedule. Its drives are wiped or destroyed when it’s replaced. |
| HR and payroll files | [Payroll or HR vendor], the locked HR file and the controller’s office. | [Controller], with counsel and your CPA. The IRS says at least 4 years for employment tax records. | Shredding for paper. Deletion at the vendor when the period or the contract ends. |
| Backups | [Backup vendor or cloud], the backup device on site, and old drives or tapes. | [IT or operations manager]. A deleted record can live on in backups until they age out, so write that period down too. | Versions expire on schedule. Old drives and tapes are wiped or destroyed, with a certificate when a vendor does it. |
The safeguards around these systems belong in your written information security program. This schedule is where the clock for each one gets written down.
The template
The Dealership Data Retention Policy Template
Download it as an editable Word file or a printable PDF. Same eight sections, same numbers, and the schedule comes with it. Fill in the brackets first. Then hand it to your attorney.
Where Helion fits
The periods and the final policy are the dealer’s to set. A complimentary IT and cybersecurity assessment looks at where the store stands against the FTC Safeguards Rule’s requirements and puts the findings in writing.
Data retention policy: section by section Each numbered line is a rule the store follows. Anything in [brackets] is yours to fill in or change.
1 What this covers
- 1.1 This policy covers every record [Dealership Name] creates or receives, on paper, in any system, on any device, and at any vendor that holds it for us.
- 1.2 The policy owner is [name, title]. Questions about keeping or destroying a record go to [name, phone].
- 1.3 When a law, a regulation or a contract sets a different period, we follow the longer one unless counsel says otherwise.
2 Owners
- 2.1 Every record type in the schedule has an owner, named by title.
- 2.2 The owner knows where every copy lives, including copies at vendors.
- 2.3 Nothing is destroyed early without the owner’s approval, and nothing on legal hold is destroyed at all.
3 The retention schedule
- 3.1 We keep each record for the period in the schedule, then destroy it the way section 6 says.
- 3.2 [Policy owner] sets each period with counsel and our outside CPA, as a number of days, months or years, never “as needed.”
- 3.3 Customer information we haven’t used to serve that customer in two years is destroyed, unless the schedule names a reason to keep it.
- 3.4 A new type of record goes on the schedule before we start collecting it.
Line 3.3 follows the FTC Safeguards Rule, which calls for disposing of customer information “no later than two years after the last date the information is used” to serve the customer. It allows exceptions for business need, legal requirements and records that can’t practically be pulled out, and counsel decides which ones you name.
4 Where records live, vendors included
- 4.1 The schedule lists every system, room and vendor that holds a copy of each type of record.
- 4.2 Vendor contracts say how long the vendor keeps our data, and how it’s returned or deleted when the contract ends.
- 4.3 At the end of a period or a contract, we ask each vendor to confirm the deletion in writing.
- 4.4 Records never go to personal email, personal cloud accounts or personal phones.
For 4.1, a vendor inventory worksheet gives you the list to start from. Line 4.4 matches the rules staff sign in an acceptable use policy.
5 Legal holds
- 5.1 When we expect a lawsuit, audit, investigation or claim, [name] puts a written hold on the records involved.
- 5.2 A hold stops all destruction of those records, including automatic deletion in email, phone, camera and backup systems.
- 5.3 Only [counsel or name] lifts a hold.
Regulation B has its own version. A creditor that has actual notice it’s under investigation or subject to an enforcement proceeding for an alleged violation, or that has been served with a lawsuit under the Act, keeps the credit records past the usual 25 months until the matter is finally resolved (12 CFR 202.12(b)(4)).
6 How records are destroyed
- 6.1 Paper goes in [locked shred bins] and is cross-cut shredded or destroyed by [destruction vendor], never put in the trash.
- 6.2 Computers, copiers, phones, drives and backup media are wiped or destroyed before they’re sold, donated, recycled or sent back at lease end.
- 6.3 We hire a destruction vendor only after checking it out, and the contract says what it destroys and how.
- 6.4 Data in cloud systems is deleted through the vendor, and backups age out on schedule.
Section 6 follows the FTC Disposal Rule, which covers information from consumer reports, like the credit report pulled for a deal. Its examples include “burning, pulverizing, or shredding” papers and “destruction or erasure of electronic media,” and selling, donating or transferring computer equipment that stores that information counts as disposal. Line 6.2 is easier with IT asset management that tracks every device to its last day.
7 Proof
- 7.1 Each destruction is logged with the type of record, the date range, the method and who did it.
- 7.2 Certificates of destruction from vendors are kept for [period].
8 Review and sign-off
- 8.1 [Policy owner] reviews this policy and the schedule [every year] and whenever we add a system, a vendor or a store.
- 8.2 Approved by [name, title, date].
Line 8.1 is the periodic review the Safeguards Rule asks for. Date every one. Our FTC Safeguards Rule checklist lists the retention policy and a log of what was destroyed among the proof to keep.
How to Put a Data Retention Policy in Place
The writing is the quick part. Finding every copy takes the legwork, so start there, and plan on asking each vendor the same three questions. What do you keep, for how long, and how do you delete it?
-
1
Walk every department
Ask sales, F&I, service, parts, the office and HR what they keep, where they keep it, and which vendors hold copies.
-
2
Set periods with counsel and your CPA
Bring the filled-in schedule. Rules that set a period go in first, then the store’s own choices.
-
3
Turn on the deletion
Set auto-delete in email, phone and camera systems, sign a shredding contract, and send each vendor your periods.
-
4
Log it and look again
Keep the destruction log and certificates, and review the schedule every year and whenever a system or vendor changes.
Which Rules Already Set a Retention Period?
Some federal rules do, for specific records. The three below cover credit applications, some tax records and an outer limit for customer information, and they are examples, not a complete list. Other rules can apply to other lines on the schedule.
State law can add its own periods, and a group with stores in more than one state may have to meet more than one set of them. Our guide to dealership privacy laws by state maps those laws. That’s why every period in this template is a blank for counsel and your CPA to fill in, with the rule written next to it.
Cite the rule, or call it a choice.
FTC Safeguards Rule
16 CFR 314.4(c)(6) calls for disposing of customer information “no later than two years after the last date the information is used” to serve the customer, unless a business, legal or practical reason says to keep it.
Two years is a ceiling with exceptions, not a target.
Regulation B
For a dealer acting as a creditor, 12 CFR 202.12(b) says to keep consumer credit applications and the records used to evaluate them for 25 months after notifying the applicant of action taken. Business credit has shorter periods.
That’s a floor for the credit pages, not the whole jacket.
IRS
The IRS asks a business to keep a copy of every Form 8300 it files, with its supporting documents, “for at least five years from the date filed,” and employment tax records for at least 4 years after the tax is due or paid, whichever is later.
Your CPA owns these lines.
Who’s Behind This Data Retention Policy Template
Helion Technologies has worked only with automotive and heavy truck dealerships since 1997. Managed IT, cybersecurity and compliance run as one team here, so the systems on your schedule and the controls around them can sit with one owner instead of several.
Common Questions
Finished the schedule?
A complimentary IT and cybersecurity assessment looks at the systems behind it and where the store stands against the FTC Safeguards Rule, and puts the findings in a written report.
What should a data retention policy include?
Do backups have to follow the schedule?
How long should a dealership keep deal jackets?
How is the Disposal Rule different from the Safeguards Rule?
Does the FTC Safeguards Rule require a data retention policy?
Do we need an attorney to review this?
What about customer data our vendors hold?
Your schedule says what to keep and for how long. A complimentary assessment looks at the systems that hold it and puts what it finds in a written report.
Get Your Complimentary IT & Cybersecurity Assessment →