Short answer: a fax retention policy fits on one page: a retention period per document family, a single folder tree where every fax gets the same naming rule, access limited to the teams that need it, and disposal planned at the end of each period — reviewed once a year, logged and signed off by management. Here is how to build it, with a durations table to adapt.
“Keep everything” is not a policy
In many SMEs a fax arrives, gets printed, is filed “somewhere” and — just in case — never leaves. That caution is expensive:
- wasted time: finding the signed quote for an unhappy client can take hours in unsorted folders, where a naming rule brings it back in thirty seconds;
- storage: an SME receiving 40 faxes a month accumulates 480 a year, more than 2,400 in five years — paper, scans and working copies combined;
- exposed data: payslips, prescriptions and bank details sit in cabinets open to everyone;
- litigation risk: records you should have destroyed long ago can resurface in a dispute — and weigh against you — instead of the document that protects you.
GDPR adds a clear obligation: keep personal data only as long as the purpose requires. The full framework is set out in our GDPR obligations applied to online fax; the retention schedule is its practical offshoot.
Four duration families, one logic
The right question is not “how long do we keep a fax?” but “what does this document prove, and until when might we need it?”. Four families cover most of an SME:
- Accounting and tax — received invoices, statements, confirmed orders. Accounting records are often kept around ten years depending on the jurisdiction: take that as your baseline, then have your accountant confirm the exact figure.
- Contracts and sales — signed quotes, purchase orders, negotiation threads. During the business relationship, then until the limitation period expires — years, again depending on the jurisdiction.
- HR and payroll — contracts, amendments, disciplinary notes. For the length of the employment relationship, extended by the years set by employment law — often five or more.
- Proof of sending — the transmission report, kept exactly as long as the document it proves. No longer, no less.
The table below can be copied into an internal memo as-is, then adapted:
| Family | Faxes concerned | Starting duration to adapt |
|---|---|---|
| Accounting and tax | invoices, statements, orders | common baseline: 10 years depending on jurisdiction |
| Contracts | signed quotes, purchase orders | business relationship + limitation period |
| HR and payroll | contracts, payslips, notes | employment + about 5 years |
| Proof of sending | timestamped transmission reports | same duration as the document proved |
Have each line validated by your counsel and note the source of every duration: the memo, not the team's memory, is what counts.
Where to store: one tree, one naming rule, real access control
A tree that still reads in ten years
One root per year, one branch per family, one subfolder per month or per counterparty: a fax from April 2027 is found without anyone's memory, under /2027/accounting/04/. When a delivery report PDF arrives, always apply the same naming rule — ISO date first, so alphabetical order is chronological too:
2026-11-11_order-p0417_valtin-group.pdf
Keep the digital original when there is one: the received PDF and its timestamped report beat a fresh scan of crumpled paper, and the filing happens once.
Who accesses what
Accounting owns the accounting folder, HR the payroll folder, management the contracts; other teams get read-only access — or none at all for sensitive flows: health, payroll, legal disputes. If your tool allows it, log file opens: unexpected browsing of the salary folder shows up, and can be watched. For the full method — formats, backups, remote retrieval — read our guide to archiving your faxes.
The transmission report: what proves, what clutters
What proves: date and time of the send, the number called, the page count and the delivery status. A timestamped PDF report carries all of it — the evidential value of a transmission report rests on these elements. That report is stored with the document it proves and follows its retention period.
What clutters: drafts, duplicate scans, reprinted copies, reports kept “just in case” with no attached document. Destroy them quickly: they add nothing to the file and widen the exposure of sensitive data.
A simple rule: one fax = one document = one report — never the other way round.
From intermediate archiving to controlled disposal
At year-end, freeze the closed year's folder: read-only, access limited to its owner and management. That is intermediate archiving: the current year stays alive, earlier ones are consulted but never changed.
Every new year, the disposal review follows the same ritual:
- list the series whose retention period has expired;
- check that no lawsuit or audit in progress freezes those records — when in doubt, keep;
- destroy: cross-cut shredding for paper, permanent erasure for files, never just the recycle bin;
- log it in a disposal register: date, series, volume, method, who approved it.
Two people sign off sensitive series, management countersigns: the register proves controlled disposal, not a loss.
One last tip to start now: apply the policy to faxes from today onwards, then catch up on the backlog one year at a time, most recent first. Three passes later the archive meets the rule — and “keep everything” stops being your SME’s policy.
Tagsarchivagedocumentspreuvergpdorganisation
