Preservation obligations apply to organisations of every size. A small business can meet them with a proportionate, documented effort.
Recognise the trigger. A demand letter, a lawyer’s call, a serious complaint, a government inquiry, or a decision to sue. Record the date.
Identify what exists. For most small businesses: email, a shared drive or cloud storage, an accounting system, a CRM, text messages on personal phones, messaging applications, and paper. The last two are the ones most often forgotten.
Stop deletion. Turn off automatic purge settings, suspend any document destruction routine, and instruct staff in writing not to delete, and not to trade in or wipe devices.
Written notice to everyone likely to hold relevant material, in plain terms: what the matter is about, what to keep, what not to do, and whom to ask. Acknowledgement by reply email is sufficient.
Personal devices. Where business is conducted by text or messaging, those messages must be preserved. Instruct staff to disable disappearing messages and to back up the device.
Cloud accounts. Confirm what the provider retains and for how long, and extend retention where possible.
Document what was done. A short memorandum recording the steps taken and the dates is the difference between a defensible effort and a sanctions motion.