Jump to section
Every Canadian law society requires lawyers to keep client records for a minimum period after a matter closes, and most require you to have a system for managing and eventually destroying those records. Most small firms have neither a policy nor a system. They have a server (or a filing cabinet, or a cloud folder) that accumulates files indefinitely, because deleting anything feels risky and nobody has time to think about it. This post gives you a policy you can actually implement and the reasoning behind each part of it.
A data retention policy is not a bureaucratic exercise. It is a set of decisions you make once, write down, and then follow without having to think through every individual file. Done right, it reduces your storage costs, reduces your exposure in the event of a breach, and means you can answer a law society audit question about your records practices in under a minute.
What Your Law Society Actually Requires
The baseline retention requirement varies by province, but most Canadian law societies require lawyers to retain client files for a minimum of 10 years after a matter closes, with some exceptions for certain matter types. Trust accounting records typically have their own retention periods, often 7 years, set by the law society's accounting rules. Corporate records for corporations you act for may need to be kept longer.
Before you write your policy, look up the specific requirements for your province. The Law Society of Ontario, the Law Society of British Columbia, and the other provincial bodies all publish guidance on this. What follows is a framework that works in most Canadian contexts, but your provincial rules are the floor, not the ceiling, and your policy has to clear them.
Note. "Client file" in your law society's guidance usually means the full matter record: correspondence, documents, notes of attendances, and a copy of documents held in trust. Check what your provincial rules specifically list, because the definition matters for what you need to keep.
The Four Questions a Policy Has to Answer
A workable retention policy answers four questions for every category of record the firm creates.
First: how long do we keep it? This is the retention period, and it has a minimum set by professional rules and a practical maximum set by the cost and risk of keeping old data.
Second: where is it kept? A file that has to be kept for 10 years but is stored on a platform that might not exist in 5 years is not actually retained. Your policy has to address storage media, backup, and accessibility.
Third: who is responsible for it? Someone at the firm needs to own the process of closing files, triggering the retention clock, and eventually reviewing and destroying old records. In a solo practice that is you. In a small firm it might be a practice manager or a senior assistant. Name the person.
Fourth: how do we destroy it when the time comes? Destruction of client records is not as simple as deleting a folder. Paper records typically require cross-cut shredding by a certified service. Electronic records require secure deletion that actually clears the data rather than just removing the file pointer. Your policy should specify the method.
A Simple Retention Schedule for a Small Firm
Here is a schedule that fits most small Canadian firms. Adjust the periods to match your provincial law society guidance, and add any matter types specific to your practice area.
Illustrative retention periods by record type
These figures are illustrative of common practice. The authoritative source is your law society's rules and any applicable provincial legislation. For estate matters and certain corporate work, longer periods may be appropriate depending on the nature of the file.
The File-Closing Trigger
The retention clock starts when the matter closes, not when you remember to close it. Many small firms have dozens or hundreds of technically closed matters that were never formally closed in the system, which means no one knows when the clock started, and old records accumulate indefinitely.
A clean file-closing process solves this. When a matter ends, someone follows a short checklist: deliver final documents to the client, send a closing letter, transfer original documents to the client if required, confirm the trust balance is zero, mark the file closed in the system with the closing date. That closing date is what starts the retention period. The post on what a file-closing checklist should cover goes into detail on the steps.
Once the file is closed in your system, a calendar entry or an automated reminder set for the end of the retention period tells you when to review the file for destruction. In a practice management system, this can be an automatic date field. In a simpler setup, it is a recurring calendar entry. Either way, it has to be written somewhere, because a retention policy that requires someone to remember is not a policy.
Tip. Set the destruction review date one year before the retention period expires, not on the last day. That gives you time to confirm whether there is any reason to extend, without the pressure of a hard deadline.
Retention and AI Tools
If your firm uses AI tools that process client data, your retention policy needs to cover those tools explicitly. When you run a client document through an AI tool, that data may be retained on the vendor's servers under the vendor's retention policy, which is probably not the same as yours.
This is one of the practical reasons to ask vendors the questions covered in ten questions to ask a legal AI vendor: you need to know how long the vendor retains your data, whether you can delete it on demand, and whether their retention timeline is compatible with your professional obligations. A vendor that retains all queries for 24 months after cancellation may be holding client information past the point where your own policy would have required destruction.
Your policy should state that client data may only be processed through approved tools, and that the data handling and retention terms for each approved tool must be reviewed against the firm's retention policy before the tool is added to the approved list. This is a one-paragraph addition to the policy, and it closes a gap that most small firms have not noticed yet.
Making Destruction Happen
Most small firms have a retention policy that says records will be destroyed after the required period. Most of those firms have never actually destroyed a client file. The destruction step is the one most likely to be skipped, because it requires deliberate action rather than inaction.
Build destruction into a routine. Once a year, the person responsible for records reviews all files whose retention date falls within the next 12 months. For each one, they confirm there is no active litigation, no regulatory inquiry, no ongoing relationship with the client that would justify extending the period, and no specific reason to keep the file. If none of those reasons apply, the file goes to destruction following the method specified in the policy.
Paper files get picked up by a shredding service that issues a certificate of destruction. Electronic files are deleted using a method that actually clears the data (most operating systems have a secure delete option, and many cloud storage providers offer a way to confirm deletion from all backup systems). Keep a record of what was destroyed, when, and how. If your law society ever asks, that record is your proof of compliance.
One Page Is Enough
Your retention policy does not need to be long. It needs to be accurate, followed, and maintained. A single page with the retention schedule, the file-closing trigger, the person responsible, and the destruction method is enough for most small Canadian firms. Review it annually alongside your AI policy and your security practices. These three documents reinforce each other: good data hygiene in the firm means knowing what you have, where it is, how it is protected, and when it should be gone.
If you want to see how this fits into the broader picture of running a secure small practice, the posts on data security basics and cloud storage and client confidentiality cover the adjacent ground. The legal tech and AI hub connects retention policy to AI tool governance and the other operational habits that keep a small firm compliant. And for firms managing all of this inside a single system, A1 CMS keeps matter records, closing dates, and document history in one place so retention tracking is part of the normal workflow, not a separate project.
