Knowledge Hub
for Growth


How to write a data retention policy

Most companies now steadily accumulate data from a range of sources, and as businesses strive for complete GDPR compliance, the question of how they manage and dispose of the data they hold has become key. A comprehensive data retention policy document demonstrates your organisation’s compliance with some basic principles of GDPR. Providing staff with the tools to implement and follow a clear data retention policy minimises the chances that your business will face regulatory scrutiny and sanction from the Information Commissioner’s Office (the ICO).

Throughout this article we'll link to additional relevant guides. You may find it useful to refer to these in conjunction with this article. Or if you have a specific enquiry, our expert data protection solicitors can provide advice tailored to your business goals.

Here we look in detail at what is involved in writing a data retention policy.

What is a data retention policy?

A data retention policy or records management policy specifies how you manage the data you hold. It identifies the types of data you have and sets out procedures for data management, data disposal and data destruction. Even a simple data retention policy should include information on key data management personnel and set out how staff members are to be trained in data retention.

How long can you retain personal data?

Indicative timeframes for retention and disposal of particular classes of information are usually contained in a schedule to the main data retention policy document.

It’s important to note that while personal data considerations are essential to your records management policies, data retention is concerned with non-personal data as well. This means the policy will have a wider application within your organisation than simply as a method of demonstrating your compliance with data protection laws like UK GDPR. For example, it might deal with retention of documents for your own tax purposes and documents you are required to hold under company law.

For a clear understanding of the information that counts as personal data, potential identifiers, related factors or special categories, see our guide to what is personal data under GDPR?

Do you need a data retention policy?

Many of the small and medium-sized businesses we act for question whether they need a data retention policy at all. The ICO has indicated that small companies undertaking occasional low-risk processing might not need a formal retention policy. But remember, if you decide not to draw up a data retention policy you still need to regularly review the data you hold and delete whatever you no longer need. So you may feel having one in place would be beneficial.

The reality is that most companies will need a data retention policy of some kind. That’s because of three principles contained in GDPR:

  1. Data minimisation: GDPR article 5(1) (c) indicates that the personal data you hold needs to be limited. Ask yourself why you obtained the data in the first place. If you no longer need the data for that reason then there is no need for you to hold on to it
  2. Storage limitation: Data that identifies data subjects can only be stored for a strict period of time. Organisations need to establish time limits to ensure they are not holding onto sensitive information indefinitely
  3. Accountability: GDPR requires companies to proactively demonstrate compliance with the rules. A data retention policy is one way of doing this.

What’s the importance of data retention policies?

If the idea of creating a data retention policy appears daunting it’s worth highlighting that, apart from demonstrating GDPR compliance, following such a policy reduces the risk that you will use data in error or that the data you hold will be the subject of a data breach.

Regular deletion of unnecessary data also reduces the amount of data you need to sift through to comply with subject access requests. It also reduces costs of storage and document management.

How to create a data protection policy

It’s rarely a good idea to try to imitate someone else’s data retention policy. While it’s possible to make use of data retention and destruction policy templates, each organisation will hold different types of data and for different purposes. Think about it, different organisations need to hold onto data for different purposes. You’ll therefore need to tailor your management and retention of that data specifically to your business. Because of the serious consequences of non-compliance with data protection laws it’s crucial that senior personnel are involved in the development of the data retention policy.  

We would normally advise clients to begin the creation of a data retention policy by considering what their current practice is and who is responsible for records management within the organisation. We’d then advise carrying out an in-depth data protection audit.

Auditing your data

Your policy will only be fit for purpose if it is written with the type of data your company holds in mind. You should therefore carry out a review of your data, asking the following types of questions:

  • What classes of data do you hold?
  • For what reason do you have the data?
  • Where is the data held?
  • Which sections or departments of your company process the most data?
  • Which business groups handle the most sensitive, high-risk data?

Identifying all the information you hold isn’t always a straightforward task. You can use tried-and-tested techniques, including data mapping to ensure your audit is as extensive and watertight as possible.

When you have audited your data it is sometimes useful to classify the different types of data you hold and include this information within the policy document. For example, data may be classed as publicly available, confidential or highly confidential.

Are there any legal requirements for retaining data?


Clients are sometimes surprised when we tell them that GDPR does not set out specific time limits for data to be held. The length of time you hold particular data for is a subjective decision for you to make based on your reasons for processing the data. By simply saying you will retain all data for 6 years after the last transaction is not good enough, you should be able to justify why you need to retain it for that long.

As mentioned above your data retention policy will not just cover personal data governed by GDPR. Other legislation may dictate how long you hold information. There may be minimum statutory retention periods for certain data for example, or there may be recognised best practice industry standards for retaining data that you wish to observe.

If you no longer need the data you should delete it or, if appropriate, retain it in an anonymised format. Of course in the digital age there are numerous ways in which data can be stored and when deleting data you should satisfy yourself that it has been permanently deleted or ‘purged’ from all storage systems you may operate. The ICO states that it will be satisfied that information has been ‘put beyond use’, if not actually deleted, provided that the data controller holding it:

  • is not able, or will not attempt, to use the personal data to inform any decision in respect of any individual or in a manner that affects the individual in any way;
  • does not give any other organisation access to the personal data;
  • surrounds the personal data with appropriate technical and organisational security; and
  • commits to permanent deletion of the information if, or when, this becomes possible.

The ICO further states that so long as the above safeguards are in place, it would not expect controllers to grant individuals access to personal data that is ‘put beyond use’.

Data that is simply taken offline, as opposed to being deleted permanently may technically have been deleted. But it still poses a degree of risk. Unfortunately, digital deletion always leaves a footprint. For this reason we advise clients to consider a clearly worded purging policy within the main data retention policy to ensure staff understand the need to permanently delete data in certain instances.

Creating the schedule to your data retention policy

Once you have classified the data you hold and established guidelines for retention periods you should compile the information in a schedule and include this as an annex to your data retention policy document. Typically the schedule will follow a similar format to this:

DATA CLASS RETAIN FOR: ACTION ON RETENTION EXPIRY OWNER OF DATA COMMENTS
e.g. employee records six years (period decided by you) e.g delete, review or anonymise relevant department e.g. HR list reason for retention period and/or any relevant statutory retention period

It’s crucial that you apply consistent periods of retention and reasoning for that retention of data in the same class and for each department.

How often does your data retention policy need to be reviewed?

Once in place the data retention policy should be reviewed regularly. You may begin to process different types of information for example, or legislation affecting your business and the type of data it processes may change. An individual should be allocated the task of reviewing the policy at set intervals.

About our expert

Lillian Tsang MBA

Lillian Tsang MBA

Senior Data Protection and Privacy Solicitor
Lillian is an experienced data protection and privacy lawyer who qualified in 2008. She advises clients on a broad range of matters - from strategic compliance with a global stance to day-to-day operations. Her role also includes Harper James' Head of DPOaaS division (Data Protection Officer as a Service), where we act as the external DPO for a business or provide support to existing DPOs.


What next?

If you need advice on data retention policies and how to develop one for your organisation we are ready to help. Call us on 0800 689 1700, email us at enquiries@harperjames.co.uk, or fill out the short form below with your enquiry.

Your data will only be used by Harper James Solicitors. We will never sell your data and promise to keep it secure. You can find further information in our Privacy Policy.


Our offices

A national law firm

A national law firm

Our commercial lawyers are based in or close to major cities across the UK, providing expert legal advice to clients both locally and nationally.

We mainly work remotely, so we can work with you wherever you are. But we can arrange face-to-face meeting at our offices or a location of your choosing.

Head Office

Floor 5, Cavendish House, 39-41 Waterloo Street, Birmingham, B2 5PP
Regional Spaces

Capital Tower Business Centre, 3rd Floor, Capital Tower, Greyfriars Road, Cardiff, CF10 3AG
Stirling House, Cambridge Innovation Park, Denny End Road, Waterbeach, Cambridge, CB25 9QE
13th Floor, Piccadilly Plaza, Manchester, M1 4BT
10 Fitzroy Square, London, W1T 5HP
Harwell Innovation Centre, 173 Curie Avenue, Harwell, Oxfordshire, OX11 0QG
1st Floor, Dearing House, 1 Young St, Sheffield, S1 4UP
White Building Studios, 1-4 Cumberland Place, Southampton, SO15 2NP
A national law firm

Like what you’re reading?

Get new articles delivered to your inbox

Join 8,153 entrepreneurs reading our latest news, guides and insights.

Subscribe


To access legal support from just £145 per hour arrange your no-obligation initial consultation to discuss your business requirements.

Make an enquiry