Retention Schedules in Plain Terms

Build the schedule around record categories

A retention schedule begins with an inventory of the monitoring information the organisation collects. Avoid treating all dashboard entries as one record type. Device activity summaries, location histories, browsing records, communication content and call records may serve different purposes and present different privacy risks. Their retention arrangements should reflect those differences rather than following one convenient default for every category.

For each category, record its purpose, source, sensitivity, responsible department, approved retention criterion and disposal method. Include the date when the record first becomes eligible for review. A schedule should also identify whether the information is held in a monitoring dashboard, exported into an investigation file or copied into another business system. Otherwise, deleting the original record may leave additional copies untouched.

• List every category of monitoring information collected.
• Identify the business purpose for each category.
• Record where original records and copies are stored.
• Assign a responsible owner for retention decisions.

Choose periods that can be justified

A retention period should be based on an identifiable need, not on the assumption that information might become useful one day. Consider how long the organisation genuinely needs a particular record to fulfil its stated purpose, meet an applicable legal obligation or resolve a foreseeable business matter. More detailed and sensitive information generally requires especially careful justification because retaining it creates continuing privacy and security responsibilities.

There is no universal period suitable for every workplace monitoring record. Employment requirements, data protection legislation, sector-specific rules and other local obligations may affect the decision. An employer should check the relevant local rules and seek legal advice when the position is uncertain. A schedule should state the reasoning behind each period so that the organisation can explain its decisions rather than relying on an arbitrary retention setting.

Separate routine records from exceptional cases

Routine monitoring records should follow the normal retention schedule. However, a documented investigation, formal complaint, litigation or regulatory request may require particular records to be preserved beyond their ordinary review point. This should be a controlled exception, not a reason to suspend deletion across the entire monitoring system. Identify the relevant records, document the reason for preservation and restrict access to the people handling the matter.

Every exception should have an owner and a review date. When the investigation or other preservation requirement ends, the records should return to the ordinary retention process or be deleted if no continuing purpose exists. The organisation should also record which copies were preserved and where they are held. This avoids an informal collection of old monitoring records that gradually becomes difficult to manage.

• Record the reason for every retention exception.
• Identify the specific records affected.
• Restrict access during the exception.
• Review the exception when circumstances change.

Account for the information held by monitoring software

An online dashboard may bring together several kinds of device information. mSpy's official feature list includes GPS location information and route history, geofence alerts, Wi-Fi network lists, supported messaging and social application monitoring, SMS, email, call logs, browser history, bookmarks, contacts and calendar information. Other listed capabilities include photo and video viewing. Which features are available depends on the operating system, version, plan, setup and required permissions. The presence of a record in a dashboard does not establish a continuing reason to retain it.

Employers should establish how the monitoring provider's available retention and deletion arrangements interact with their own schedule. Check what happens to information that is exported, downloaded or incorporated into another business record. Do not assume that removing an entry from one view deletes every copy or that a provider's default arrangement meets the organisation's legal obligations. The official website should be consulted for current product information, while the employer remains responsible for its own retention decisions.

Make deletion and review accountable

A written schedule needs a practical process for carrying it out. Assign responsibility for identifying records due for review, approving any justified extension and confirming disposal. The process should cover dashboard information, exported files, investigation folders and other locations where monitoring records may have been copied. Where a system does not support the required deletion or reporting arrangements, document the limitation and establish an appropriate alternative control.

Consent and transparency should also inform retention decisions. Employees should receive a written monitoring policy and notice explaining the types of information collected, the purposes for which it is used and the applicable retention approach. Parents and legal guardians using mSpy to supervise their own minor children should explain monitoring openly in an age-appropriate conversation. More intrusive features, including keystroke logging, screen capture, live streaming and call recording, require particular attention to proportionality and legal limits.

• Assign an owner to each retention category.
• Schedule periodic checks of records due for deletion.
• Record approved extensions and their reasons.
• Verify the treatment of copies and exported files.
• Keep evidence that disposal procedures were completed.

Questions readers ask