Effective date: January 1, 2025 · Last updated: June 12, 2026
⚖️ Legal Notice
This Data Retention Policy is a TEMPLATE and must be reviewed by qualified legal counsel. Retention periods vary by jurisdiction, industry, and data type. Canadian businesses must comply with CRA requirements (7 years), but other jurisdictions may have different rules.
This Data Retention Policy outlines how long My Virtual Accounting Firm (MVAF) retains different types of data, the legal basis for retention periods, and the procedures for secure deletion. This policy complies with Canadian federal and provincial recordkeeping requirements, including those set by the Canada Revenue Agency (CRA), Revenu Québec, and other regulatory bodies.
| Data Category | Retention Period | Legal Basis | Deletion Method |
|---|---|---|---|
| Financial Records (Invoices, Receipts, Bank Statements) | 7 years from end of last tax year | Income Tax Act (Canada), CRA Requirement | NIST 800-88 sanitization |
| Payroll Records (T4s, ROEs, Pay Stubs, Deductions) | 7 years from end of last tax year | Employment Insurance Act, Income Tax Act | NIST 800-88 sanitization |
| Tax Returns and Supporting Documents | 7 years from filing date | CRA Audit Requirements | NIST 800-88 sanitization |
| General Ledger and Journal Entries | 7 years from transaction date | CRA Recordkeeping Requirements | NIST 800-88 sanitization |
| Corporate Minute Books and Share Registers | Indefinitely (or 7 years after dissolution) | Canada Business Corporations Act | Secure archival storage |
| User Account Information (Email, Name, Role) | Account active + 7 years post-termination | Contractual necessity + CRA requirements | Account deletion + archival purge |
| Login Logs and Audit Trails | 2 years from creation | Security monitoring (legitimate interest) | Automated deletion |
| AI-Generated Insights and Health Scores | 3 years from generation | Service delivery (contractual necessity) | Automated deletion |
| Deleted Transactions (Archive) | 90 days, then permanent deletion | Recovery window (legitimate interest) | Automated purge |
| Email Communications with Support | 5 years from last communication | Contractual + quality assurance | NIST 800-88 sanitization |
| Social Insurance Numbers (Last 3 digits only) | 7 years from employee termination | ROE generation (Employment Insurance Act) | Field-level deletion |
| Payment Processing Records | 7 years from transaction | CRA, PCI-DSS, financial regulations | NIST 800-88 sanitization |
The Income Tax Act requires businesses to keep records for 7 years from the end of the last tax year to which they relate. This includes all financial transactions, supporting documents, invoices, receipts, and payroll records. Failure to maintain records can result in penalties of up to CAD $25,000.
Quévincial tax law requires retention of tax-related documents for 7 years from the end of the taxation year. Businesses operating in Québec must comply with both federal (CRA) and provincial requirements.
Employers must retain Records of Employment (ROE), payroll registers, and related documents for 7 years. This includes employee names, SIN (last 3 digits), insurable earnings, and reason for leaving.
Federal corporations must maintain minute books, share registers, and director/officer records indefinitely or until 7 years after corporation dissolution.
PIPEDA requires that personal information be retained only as long as necessary for the purposes for which it was collected. However, this is overridden by CRA requirements for financial records.
Québec's privacy law requires businesses to conduct privacy impact assessments, appoint a privacy officer, and implement data retention and deletion policies. Applies to businesses operating in Québec or handling Québec residents' data.
When data reaches the end of its retention period, we employ industry-standard deletion methods to ensure complete and irreversible removal:
For most data: overwrite with random data, clear file system references, and remove from backups.
For encrypted data: deletion of encryption keys renders data unrecoverable.
For decommissioned storage media: physical shredding or degaussing per NIST 800-88 guidelines.
We require third-party processors (e.g., cloud providers, backup services) to certify deletion upon request.
Due to legal requirements, we CANNOT delete the following data before the 7-year CRA retention period expires:
Exception: If you have a legal right to erasure (e.g., under GDPR for EU residents), we will review requests on a case-by-case basis, balancing your rights against our legal obligations.
Data Protection Officer: privacy@myvirtualaccountingfirm.com
Data Export Requests: data@myvirtualaccountingfirm.com
Mailing Address: Privacy Officer, My Virtual Accounting Firm, 2131 Williams Parkway, Unit 20, Brampton, ON L6S 5Z4, Canada
⚖️ Legal Disclaimer
This Data Retention Policy is a TEMPLATE and must be reviewed by qualified legal counsel. Retention periods and legal requirements vary by jurisdiction, industry, and business type. Consult with a lawyer specializing in privacy law and financial services to ensure compliance with all applicable regulations before implementing this policy.
© 2026 My Virtual Accounting Firm ·Privacy Policy ·Terms of Service