Most companies now steadily accumulate data from a range of sources, and as businesses strive for complete GDPR compliance, the question of how they manage and dispose of the data they hold has become key. A comprehensive data retention policy document demonstrates your organisation’s compliance with some basic principles of GDPR. Providing staff with the tools to implement and follow a clear data retention policy minimises the chances that your business will face regulatory scrutiny and sanction from the Information Commissioner’s Office (the ICO).
Throughout this article we'll link to additional relevant guides. You may find it useful to refer to these in conjunction with this article. Or if you have a specific enquiry, our expert data protection solicitors can provide advice tailored to your business goals.
Here we look in detail at what is involved in writing a data retention policy.
We'll examine:
- What is a data retention policy?
- How long can you retain personal data?
- Do you need a data retention policy?
- What’s the importance of data retention policies?
- How to create a data protection policy
- Auditing your data
- Are there any legal requirements for retaining data?
- Creating the schedule to your data retention policy
- How often does your data retention policy need to be reviewed?
What is a data retention policy?
A data retention policy or records management policy specifies how you manage the data you hold. It identifies the types of data you have and sets out procedures for data management, data disposal and data destruction. Even a simple data retention policy should include information on key data management personnel and set out how staff members are to be trained in data retention.
How long can you retain personal data?
Indicative timeframes for retention and disposal of particular classes of information are usually contained in a schedule to the main data retention policy document.
It’s important to note that while personal data considerations are essential to your records management policies, data retention is concerned with non-personal data as well. This means the policy will have a wider application within your organisation than simply as a method of demonstrating your compliance with data protection laws like UK GDPR. For example, it might deal with retention of documents for your own tax purposes and documents you are required to hold under company law.
For a clear understanding of the information that counts as personal data, potential identifiers, related factors or special categories, see our guide to what is personal data under GDPR?
Do you need a data retention policy?
Many of the small and medium-sized businesses we act for question whether they need a data retention policy at all. The ICO has indicated that small companies undertaking occasional low-risk processing might not need a formal retention policy. But remember, if you decide not to draw up a data retention policy you still need to regularly review the data you hold and delete whatever you no longer need. So you may feel having one in place would be beneficial.
The reality is that most companies will need a data retention policy of some kind. That’s because of three principles contained in GDPR:
- Data minimisation: GDPR article 5(1) (c) indicates that the personal data you hold needs to be limited. Ask yourself why you obtained the data in the first place. If you no longer need the data for that reason then there is no need for you to hold on to it
- Storage limitation: Data that identifies data subjects can only be stored for a strict period of time. Organisations need to establish time limits to ensure they are not holding onto sensitive information indefinitely
- Accountability: GDPR requires companies to proactively demonstrate compliance with the rules. A data retention policy is one way of doing this.
What’s the importance of data retention policies?
If the idea of creating a data retention policy appears daunting it’s worth highlighting that, apart from demonstrating GDPR compliance, following such a policy reduces the risk that you will use data in error or that the data you hold will be the subject of a data breach.
Regular deletion of unnecessary data also reduces the amount of data you need to sift through to comply with subject access requests. It also reduces costs of storage and document management.
How to create a data protection policy
It’s rarely a good idea to try to imitate someone else’s data retention policy. While it’s possible to make use of data retention and destruction policy templates, each organisation will hold different types of data and for different purposes. Think about it, different organisations need to hold onto data for different purposes. You’ll therefore need to tailor your management and retention of that data specifically to your business. Because of the serious consequences of non-compliance with data protection laws it’s crucial that senior personnel are involved in the development of the data retention policy.
We would normally advise clients to begin the creation of a data retention policy by considering what their current practice is and who is responsible for records management within the organisation. We’d then advise carrying out an in-depth data protection audit.
Auditing your data
Your policy will only be fit for purpose if it is written with the type of data your company holds in mind. You should therefore carry out a review of your data, asking the following types of questions:
- What classes of data do you hold?
- For what reason do you have the data?
- Where is the data held?
- Which sections or departments of your company process the most data?
- Which business groups handle the most sensitive, high-risk data?
Identifying all the information you hold isn’t always a straightforward task. You can use tried-and-tested techniques, including data mapping to ensure your audit is as extensive and watertight as possible.
When you have audited your data it is sometimes useful to classify the different types of data you hold and include this information within the policy document. For example, data may be classed as publicly available, confidential or highly confidential.
Are there any legal requirements for retaining data?
Clients are sometimes surprised when we tell them that GDPR does not set out specific time limits for data to be held. The length of time you hold particular data for is a subjective decision for you to make based on your reasons for processing the data. By simply saying you will retain all data for 6 years after the last transaction is not good enough, you should be able to justify why you need to retain it for that long.
As mentioned above your data retention policy will not just cover personal data governed by GDPR. Other legislation may dictate how long you hold information. There may be minimum statutory retention periods for certain data for example, or there may be recognised best practice industry standards for retaining data that you wish to observe.
If you no longer need the data you should delete it or, if appropriate, retain it in an anonymised format. Of course in the digital age there are numerous ways in which data can be stored and when deleting data you should satisfy yourself that it has been permanently deleted or ‘purged’ from all storage systems you may operate. The ICO states that it will be satisfied that information has been ‘put beyond use’, if not actually deleted, provided that the data controller holding it:
- is not able, or will not attempt, to use the personal data to inform any decision in respect of any individual or in a manner that affects the individual in any way;
- does not give any other organisation access to the personal data;
- surrounds the personal data with appropriate technical and organisational security; and
- commits to permanent deletion of the information if, or when, this becomes possible.
The ICO further states that so long as the above safeguards are in place, it would not expect controllers to grant individuals access to personal data that is ‘put beyond use’.
Data that is simply taken offline, as opposed to being deleted permanently may technically have been deleted. But it still poses a degree of risk. Unfortunately, digital deletion always leaves a footprint. For this reason we advise clients to consider a clearly worded purging policy within the main data retention policy to ensure staff understand the need to permanently delete data in certain instances.
Creating the schedule to your data retention policy
Once you have classified the data you hold and established guidelines for retention periods you should compile the information in a schedule and include this as an annex to your data retention policy document. Typically the schedule will follow a similar format to this:
| DATA CLASS | RETAIN FOR: | ACTION ON RETENTION EXPIRY | OWNER OF DATA | COMMENTS |
| e.g. employee records | six years (period decided by you) | e.g delete, review or anonymise | relevant department e.g. HR | list reason for retention period and/or any relevant statutory retention period |
It’s crucial that you apply consistent periods of retention and reasoning for that retention of data in the same class and for each department.
How often does your data retention policy need to be reviewed?
Once in place the data retention policy should be reviewed regularly. You may begin to process different types of information for example, or legislation affecting your business and the type of data it processes may change. An individual should be allocated the task of reviewing the policy at set intervals.
