Organisations need to retain information for many different reasons, including legal and regulatory requirements, operational needs, contractual obligations and the management of potential claims. At the same time, retaining personal data for longer than necessary can create data protection, security and information management risks.
In my work with clients across different sectors, I have seen how difficult it can be to determine what information should be retained, for how long and why. Organisations may need to consider data protection requirements alongside legal, regulatory, contractual and operational needs, while also avoiding the unnecessary retention of personal data.
A structured approach to data retention can help organisations understand what information they hold, why it needs to be retained and when it should be reviewed or securely disposed of. Developing that approach may require input from different parts of the organisation, including Legal, Data Protection, Finance, HR, IT and other relevant specialists or record owners.
In this two-part series, we look at data retention for UK organisations, including how retention periods are determined, the risks associated with keeping information for longer than necessary and the role of clear retention policies, schedules and supporting procedures. Part Two considers the practical steps involved in developing and implementing a data retention approach.
Understanding data retention requirements in the UK
A useful starting point for data retention is understanding the legal and regulatory framework that applies to the organisation and the information it holds. Different requirements may apply depending on the type of record, the purpose for which it is retained and the organisation’s activities or sector. For personal data, the UK GDPR and Data Protection Act 2018 form an important part of that framework, with the Information Commissioner’s Office (ICO) providing regulatory guidance on their application.
Legal Framework: UK GDPR and Data Protection Act 2018
The UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 form the principal framework for data protection law in the UK. Together, they establish requirements governing the processing of personal data, including principles relevant to how much personal data organisations retain and how long they keep it.
Key principles include:
Purpose limitation: Personal data should be collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes.
Data minimisation: Personal data should be adequate, relevant and limited to what is necessary in relation to the purposes for which it is processed.
Storage limitation: Personal data should be kept in a form that permits identification of individuals for no longer than is necessary for the purposes for which it is processed.
Role of the Information Commissioner's Office (ICO)
The Information Commissioner’s Office (ICO) regulates data protection law in the UK and publishes guidance to help organisations understand their responsibilities. Its guidance on the storage limitation principle makes clear that organisations should consider how long personal data is needed for its stated purpose, establish appropriate retention periods where possible and periodically review the information they hold.
The appropriate period will depend on the circumstances. Organisations should be able to explain why personal data is retained for a particular period rather than treating a retention schedule as a fixed list that applies regardless of purpose.
Common Data retention periods
There is no single retention period that applies to all organisational records. Some records are subject to specific statutory or regulatory retention requirements, while other retention periods may be determined by factors such as the purpose for which the information is held, contractual requirements, limitation periods, sector guidance or the organisation’s legitimate operational needs.
A retention schedule should therefore identify different categories of records and the basis for the period applied to each. The examples below illustrate some of the considerations that may arise, but organisations should confirm the requirements applicable to their own activities and records.
Financial records
Financial and tax records can be subject to specific statutory retention requirements, and the applicable period will depend on the type of record and the organisation concerned. For example, the Companies Act 2006 generally requires a private company to preserve its accounting records for three years from the date on which they are made and a public company for six years.
Separate requirements apply to tax records. HMRC specifies record-keeping periods for areas including Corporation Tax, VAT and PAYE, and the period and its starting point can differ according to the particular requirement. Organisations should therefore identify the applicable requirement for each category of financial or tax record rather than applying a single six-year period to all financial information.
Employee Records
Employee records can include personal details, contracts, absence information, performance records, training records, payroll information and documentation relating to particular employment decisions or processes. These records should not automatically be treated as a single category for retention purposes.
Some employment and payroll records are subject to specific statutory requirements, while the retention of others may need to take account of their purpose, applicable limitation periods and the possibility of employment-related claims. Records containing special category personal data, such as health information, may also require particular care.
Recruitment records should similarly be reviewed according to their purpose. Information relating to unsuccessful applicants should not simply be retained indefinitely in case it becomes useful later; the organisation should determine and document an appropriate retention period and consider whether there is a continuing reason to retain the information.
Health and safety records
Health and safety records can be subject to different retention requirements depending on the type of record and the legislation that applies. Organisations should therefore distinguish between records such as accident information, risk assessments, exposure records and health surveillance records rather than applying a single retention period to all health and safety documentation.
Some legislation specifies particular record-keeping periods. For example, certain records relating to reportable injuries, diseases and dangerous occurrences must be retained for a prescribed period, while records relating to health surveillance under the Control of Substances Hazardous to Health Regulations 2002 (COSHH) may need to be retained for considerably longer.
Risk assessments should also be managed as controlled records and reviewed when appropriate. The period for which previous versions are retained should be determined by reference to the organisation’s legal requirements, activities and reasons for retaining evidence of earlier assessments rather than through a general rule that they must be kept permanently.
Customer data
Customer records can contain information retained for several different purposes, and those purposes may justify different retention periods. For example, information needed to administer an active customer relationship may be treated differently from transaction records retained for accounting or tax purposes, records required to deal with warranties or disputes, and information used for marketing.
Marketing data requires particular consideration. Organisations should distinguish between information used for marketing activities and records retained to demonstrate an individual’s preferences, consent or objection to marketing. In some circumstances, retaining a limited suppression record may be necessary to ensure that a person who has opted out is not inadvertently contacted again.
The appropriate retention period should therefore be determined according to the purpose of the information and the legal or operational basis for retaining it, rather than applying a single period to the entire customer record.
These examples demonstrate why a retention schedule should record more than a number of years. It should be clear what category of information is covered, why it is retained, what requirement or business need supports the retention period, when that period starts and what should happen when it expires.
Retention periods should not simply be set once and left unchanged. Organisations should periodically review their retention schedule and supporting documentation to consider whether the purposes for retaining information, applicable requirements and operational needs have changed.
The importance of data minimisation
Data minimisation is one of the principles of the UK GDPR and is closely connected with effective data retention. It requires organisations to consider whether the personal data they process is adequate, relevant and limited to what is necessary for the purposes for which it is processed.
The potential future value of data does not, by itself, justify retaining personal data indefinitely. Organisations should be clear about the purposes for which personal data is held and periodically consider whether it remains necessary for those purposes. Where information is retained for analysis, research or the development or use of technology such as AI, the organisation should still consider the applicable data protection principles and any other relevant requirements.
Under the data minimisation principle, personal data must be:
Adequate: sufficient to fulfil the purpose for which it is being processed.
Relevant: connected to and appropriate for that purpose.
Limited to what is necessary: no more personal data should be processed than is needed for that purpose.
Applying the data minimisation principle requires organisations to consider not only what personal data they collect, but also whether all of that information remains necessary as circumstances change. This works alongside the storage limitation principle and supports a more considered approach to reviewing and disposing of personal data that is no longer required.
Risks of keeping data longer than necessary
Retaining information for longer than it is needed can create additional risks for an organisation. Where personal data is involved, unnecessary retention can also conflict with the UK GDPR storage limitation principle. The nature and significance of the risk will depend on the information being held and the circumstances.
Legal compliance issues
Where personal data is retained for longer than is necessary for the purposes for which it is processed, an organisation may fail to meet the UK GDPR storage limitation principle. Keeping unnecessary personal data can also increase the amount of information that must be identified and considered when responding to data subject rights requests or other information-management requirements.
Retention decisions should be documented and capable of being justified. Where another legal, regulatory or legitimate requirement means information needs to be retained, that should be reflected in the organisation’s retention arrangements rather than assuming that personal data must always be deleted after a standard period.
Security risks
Retaining information that is no longer needed can increase the potential impact of a security incident. The more information an organisation holds, the more information may be exposed if systems or records are accessed, lost or disclosed without authorisation.
Older or forgotten information can create particular difficulties where it is held in legacy systems, duplicated across different locations or no longer subject to appropriate ownership and review. Effective retention arrangements can help organisations identify information that is no longer required and ensure that its disposal is managed appropriately.
Increased storage costs
Retaining unnecessary information can also create additional storage and management costs. As the volume of information grows, organisations may need to devote more resources to storage, backup, retrieval, access management and ongoing administration.
Effective retention arrangements can help organisations manage those volumes more deliberately by identifying when information should be reviewed and, where there is no continuing reason to retain it, securely disposed of.
Understanding data retention policies
A structured approach to data retention will usually involve more than a policy alone. A data retention policy can establish the organisation’s overall approach, responsibilities and principles, while a supporting retention schedule can set out how different categories of records should be managed and the retention periods that apply to them.
Processes and procedures can then support the practical application of those arrangements, including the review, archiving and secure disposal of information when appropriate.
The structure of an organisation’s retention documentation will depend on its size, activities and regulatory environment. Some organisations may use a single overarching data retention policy supported by a detailed retention schedule, while others may need additional arrangements for particular systems, functions or categories of information.
A retention schedule can provide the operational detail by identifying record categories, applicable retention periods, the point from which each period is calculated and the reason for retaining the information. It may also identify the relevant record owner and what should happen when the retention period expires.
Particular circumstances may require retaining information beyond its usual scheduled period. For example, records relevant to actual or anticipated litigation, an investigation or another specific legal or regulatory requirement may need to be preserved. Organisations should have a clear process for identifying and managing these exceptions rather than simply applying the normal disposal date.
Practical support with data retention
Data retention is something organisations need to consider carefully, particularly where personal data is involved. Developing and maintaining a proportionate approach can involve bringing together information about different records, systems, applicable requirements and operational needs.
Corporate Assist can provide practical support with this work, including gathering and organising information, coordinating contributions from relevant teams and helping to develop and maintain data retention documentation. Where Legal, Data Protection or other specialist input is required, we work alongside the people responsible for those assessments and decisions.
If your organisation needs additional capacity for a data retention project, get in touch to discuss your requirements.
Continue to Part 2: Data Retention for UK Organisations – Part 2 where we look at practical considerations when developing and implementing a data retention framework, including the policy, retention schedule and supporting processes.
Share this post: