Compliance Management
Document Management
Nonprofit Accounting
Nonprofit Donor Management
Nonprofit Management
Nonprofit Document Retention Policy: Template and Retention Periods by Record Type
Last updated: October 16, 2026 · Independent guide · We do not sell rankings or coverage.
A document retention policy for a nonprofit is a board-adopted policy that says which records you keep, for how long, who is responsible, and how records are destroyed. Federal tax law does not require one, but Form 990 Part VI, line 14 asks whether you have it, and federal grant, payroll and IRS rules set minimum periods for specific records. Below are a copyable policy, a sourced retention schedule by record type, and a destruction log and hold notice.
How to use this template
Part 1 is the policy your board adopts by resolution, Part 2 is its retention schedule, and Part 3 is the log that proves the policy runs. Replace “the Organization” with your legal name, have counsel add state requirements, and minute the adoption date. Where a federal rule sets a period, Part 2 cites it; where none does, the period is marked “suggested” so you can change it safely.
Part 1: Document retention and destruction policy template
| Section | Policy text (adapt to your organization) |
|---|---|
| 1. Scope | This policy covers all Organization records in any format, including paper, email, files, databases, cloud applications, chat and text messages, and records on personal devices used for Organization business. It applies to directors, officers, employees, volunteers and contractors. |
| 2. Responsibilities | The board designates [title] as Records Custodian, who maintains the schedule, issues and lifts holds, approves destruction and keeps the destruction log. Department heads are responsible for their departments’ records. Outside providers holding Organization records (payroll provider, auditor, software vendors) must keep and return them under this policy. |
| 3. Retention schedule | Records are kept for at least the period in Appendix A. If a grant agreement, contract or law requires longer, the longer period applies. Unlisted records are kept [3] years unless the Records Custodian decides otherwise in writing. |
| 4. Systems | Retention settings in email, file, accounting and donor systems must match Appendix A. No one may change those settings, bulk delete records or cancel a system holding Organization records without the Records Custodian’s written approval and an export of records still within their period. |
| 5. Destruction | Expired records not under a hold are shredded or securely deleted [annually in month] from a list the Records Custodian approves. Each batch is recorded in the destruction log. |
| 6. Holds | When the Organization receives notice of, or reasonably expects, a lawsuit, government investigation, audit, grant monitoring review or whistleblower report, the Records Custodian issues a written hold. All destruction of related records stops, including automatic deletion in any system, until the hold is lifted in writing. |
| 7. Federal awards | Federal award records, including subawards, are kept for three years from submission of the final financial report, or longer as 2 CFR 200.334 requires. |
| 8. Departing staff | Before a person leaves, their supervisor moves Organization records to Organization storage. Accounts are suspended, not deleted, until the Records Custodian confirms no hold applies. |
| 9. Review and adoption | The Records Custodian reviews Appendix A annually and reports to the [Audit/Finance] Committee. Violations may lead to discipline. Adopted by board resolution on [date]. |
Section 6 connects this policy to your nonprofit whistleblower policy, which should trigger a hold as soon as a report arrives.
Part 2: Retention schedule by record type (Appendix A)
| Record type | Retain for | Source |
|---|---|---|
| Governance: articles, bylaws, IRS determination letter, Form 1023 and IRS correspondence, board minutes and resolutions, adopted policies | Permanent | Council of Nonprofits; IRS public disclosure rules (Form 1023); suggested for bylaws and policies |
| Governance: annual conflict of interest statements | 7 years (suggested) | Suggested |
| Tax: Form 990, 990-T and state filings | Permanent (copies); public inspection required for 3 years | Council of Nonprofits; IRS public disclosure rules |
| Tax: workpapers and records supporting the return | At least 3 years after the due or filing date, whichever is later; 7 suggested | IRS Form 990 instructions |
| Donor: gift records, receipts, quid pro quo disclosures | 7 years after the fiscal year (suggested; IRS minimum 3) | IRS Form 990 instructions; suggested |
| Donor: restricted gift, endowment and bequest agreements | Permanent (suggested) | Suggested |
| Donor: noncash gifts that may need Form 8282 | At least 3 years after receipt, then the tax-record period | IRS Form 8282 |
| Federal grants: financial, supporting and statistical records | 3 years from the final financial report; longer during litigation, claims, audits or on written notice | 2 CFR 200.334 |
| Federal grants: equipment bought with federal funds | 3 years after final disposition | 2 CFR 200.334(c) |
| Private grants: agreements and reports | Grant agreement term; 7 years after closeout if none (suggested) | Suggested |
| Payroll: payroll records; time cards | 3 years; 2 years | DOL Fact Sheet 21 |
| Payroll: employment tax records | At least 4 years after filing the 4th quarter | IRS |
| HR: Form I-9 | Later of 3 years after hire or 1 year after employment ends | USCIS M-274 |
| HR: personnel and hiring records | At least 1 year, or until any charge is resolved; 7 years after separation suggested | EEOC |
| Accounting: general ledger, year-end statements, audit reports | Permanent | Council of Nonprofits; suggested for the general ledger |
| Accounting: invoices, bank statements, reconciliations | 7 years (suggested; IRS minimum 3) | Suggested |
| General: routine email and correspondence | 2 years (suggested), unless the content fits another row | Suggested |
Sources: IRS Form 990 instructions, 2 CFR 200.334, DOL Fact Sheet 21, IRS employment tax recordkeeping, USCIS, EEOC and the National Council of Nonprofits. State law may require longer periods.
Part 3: Destruction log and hold notice
| Field | What to record | Illustrative entry |
|---|---|---|
| Batch ID and records | Record types, date range, systems | 2026-02: AP invoices FY2018, finance drive and QuickBooks attachments |
| Hold check and approval | Hold register checked; Records Custodian sign-off | No match; approved November 3, 2026 |
| Method | Shredding or deletion method | Certified shredding, certificate filed |
| Hold notice | Matter, scope, recipients, system actions | Pass-through monitoring review; FY2024 to FY2026 grant records; 4 mailboxes on hold |
| Hold release | Date and written approval | Open |
Form 990 Part VI, line 14
Line 14 asks, “Did the organization have a written document retention and destruction policy?” The 2025 instructions describe one that “identifies the record retention responsibilities of staff, volunteers, board members, and outsiders for maintaining and documenting the storage and destruction of the organization’s documents and records.” They add that Sarbanes-Oxley imposes criminal liability on exempt organizations for destroying records to obstruct a federal investigation (18 U.S.C. 1519).
“No” is permitted, since Section B covers policies the Code does not require. Answer “Yes” only if the board, or an authorized committee, adopted the policy by the end of the tax year. Lines 12 and 13 use the same test for your conflict of interest policy and whistleblower policy.
Federal grant records under 2 CFR 200.334
Recipients and subrecipients must keep “all Federal award records for three years from the date of submission of their final financial report” (2 CFR 200.334). The clock starts at the final report, so first-year records on a five-year award can be kept eight years or more. Agencies and pass-through entities may not add other retention terms beyond the listed exceptions: unresolved litigation, claims or audits, written extension notices, equipment, program income and indirect cost proposals.
Under 2 CFR 200.337, federal access rights last as long as you keep the records, a reason to destroy on schedule. Record each award’s final report date and set its destruction date from it.
How accounting, donor and email systems apply retention and holds
Email and file platforms have retention engines. In the documentation we reviewed for QuickBooks Online, Sage Intacct and Bloomerang we found no scheduled deletion setting, so destruction there is manual and a hold mostly means restricting who can delete.
| System | Retention | Hold | Watch for |
|---|---|---|---|
| Microsoft 365 Purview | Retention policies and labels | eDiscovery holds keep content “until you release the hold” (Microsoft) | “The longest retention period wins” |
| Google Vault | Retention rules | “Holds take precedence over retention rules” | Confirm your plan includes Vault |
| Salesforce | Field history kept 18 months (24 via API) | Pause bulk deletes and cleanup jobs | Field Audit Trail keeps history until deleted |
| Bloomerang | Manual bulk delete | Limit Admin and Data Tools permissions | Bulk delete removes all transactions and cannot be undone |
| QuickBooks Online | Closing date with optional password | Password-protect the closing date | Read-only access ends one year after cancelling (Intuit) |
| Sage Intacct | Manual attachment deletion | Restrict attachment deletion | Attachments must be detached before deletion |
Treat a system exit as a destruction event: export everything still inside its period before cancelling, and log the export.
Common mistakes
- Counting grant retention from the award end date instead of the final financial report.
- Never destroying anything. The National Council of Nonprofits frames the policy as a way to make routine deletion consistent.
- Holds that stop at paper and miss automatic email deletion or CRM bulk deletes.
- Filing email as one category. An email approving a grant budget change is a grant record.
- Adopting after year end, which cannot support “Yes” on line 14 for that year.
When to move from a spreadsheet to software
A spreadsheet schedule and paper log suit a small office. Move to system-enforced retention when email volume makes manual deletion unrealistic or a hold must reach individual mailboxes. Start with Purview or Google Vault, which are part of the Microsoft 365 and Google Workspace platforms many nonprofits already use; check which plan tiers include them. When comparing nonprofit accounting software or donor management software, check audit trails, delete permissions and post-cancellation data terms.
How we researched this
On October 16, 2026 we read the 2025 Form 990 instructions, 2 CFR 200.334 and 200.337, IRS, DOL, USCIS and EEOC recordkeeping pages, and vendor documentation. We reviewed top-ranking guides from the National Council of Nonprofits, the Florida Nonprofit Alliance and PBMares, a CPA firm. None gives sourced periods, grant timing and system holds together. This is general information, not legal or tax advice.
Related guides
- Nonprofit Audit Checklist: PBC List and Schedules
- Gift Acceptance Policy: Template and Non-Cash Gift Rules
- Form 990 Preparation Software: From Ledger to E-File
Frequently asked questions
Is a document retention policy required for a nonprofit?
Not under the Internal Revenue Code, and “No” is a permitted answer on Form 990 line 14. Federal, state and grant rules still set minimum periods for specific records whether or not you adopt a policy.
How long should a nonprofit keep donor records?
No federal rule sets one period. The IRS minimum for records supporting your return is 3 years after the due or filing date, and many policies use 7 years. Keep restricted gift agreements permanently.
How long do you keep federal grant records?
Three years from submitting the final financial report, under 2 CFR 200.334, and longer if litigation, a claim or an audit starts first or the agency extends the period in writing.
What is a litigation hold for a nonprofit?
A written notice that suspends destruction of records tied to a lawsuit, investigation, audit or whistleblower report. It must also pause automatic deletion in your systems until lifted in writing.
Sources
- IRS, Instructions for Form 990 (2025). irs.gov
- eCFR, 2 CFR 200.334 and 200.337, up to date as of October 14, 2026. ecfr.gov
- IRS, Employment tax recordkeeping, updated June 12, 2026. irs.gov
- DOL, Fact Sheet #21, revised July 2008. dol.gov
- USCIS, Handbook M-274, 10.0 Retaining Form I-9, no date shown. uscis.gov
- EEOC, Recordkeeping Requirements, no date shown. eeoc.gov
- IRS, Public disclosure and availability of exempt organizations returns and applications, updated June 28, 2026. irs.gov
- IRS, Form 8282 (Rev. October 2021). irs.gov
- 18 U.S.C. 1519, no date shown. law.cornell.edu
- National Council of Nonprofits, Document Retention Policies, modified October 5, 2026. councilofnonprofits.org
- Florida Nonprofit Alliance, Record Retention, no date shown. flnonprofits.org
- PBMares (CPA firm), document retention guidelines, modified February 27, 2026. pbmares.com
- Microsoft Learn (vendor), retention, July 22, 2026; eDiscovery holds, June 23, 2026. learn.microsoft.com
- Google Vault Help (vendor), How retention works, no date shown. support.google.com
- Salesforce Help (vendor), Field History Tracking, no date shown. help.salesforce.com
- Bloomerang Help (vendor), Bulk delete constituents, no date shown. help.bloomerang.com
- Intuit (vendor), Lock your books, updated September 15, 2026; Cancel your QuickBooks Online subscription (US), updated September 25, 2026. quickbooks.intuit.com
- Sage Intacct Help (vendor), Best practices for attachments, October 8, 2026. intacct.com
Sherman Hsieh
Independent analysis of enterprise software — ERP, CRM and more
