What steps and processes would you develop or implement at your organization to put legal boundaries around retention?

What steps and processes would you develop or implement at your organization to put legal boundaries around retention?