Ross,

Yes, you make some good points here. A defined and explicit document retention Policy is the DBA's best protection. The DBA is, I believe, pretty safe if his disposal of data is routinely in line with the corporate document Retention policy, but once there is the first notice of any litigation, this should be overruled by the company's legal team. This is because the courts may take a dim view of any disposal of relevant potential 'evidence' after litigation commences.

I haven't experienced a logically consistent policy on the retention of data yet. I worked for a while in Telecommunications where there were two statutory retention periods for the records of telephone calls. These had to be disposed of after six months, but also had to be retained for five years.