In Part One of this series, we looked at the requirements and considerations that can affect how long organisations retain information, including the UK GDPR principles of data minimisation and storage limitation, the risks associated with unnecessary retention and the role of retention policies and schedules. Part Two turns to the practical work involved in developing and implementing a structured approach to data retention.
In practice, data retention can become complex where information is held across different teams, systems and formats, with different requirements applying to different categories of records. A structured approach can help organisations understand what information they hold, establish appropriate retention arrangements and identify where specialist input or further review is required.
In this second part, we look at practical considerations for developing and implementing a data retention framework, including understanding the information the organisation holds, determining and documenting retention periods, establishing appropriate disposal arrangements and keeping the framework under review.
Principles Supporting Effective Data Retention
Before looking at the practical development of a retention framework, it is useful to consider some of the wider data protection and governance principles that can support an organisation’s approach to managing information throughout its lifecycle.
Data Protection by design and by default
Data protection by design and by default requires organisations to consider appropriate data protection measures when determining how personal data will be processed and throughout the processing lifecycle. Data retention should form part of that consideration, including when new systems, services or processes involving personal data are being designed or introduced.
Practical considerations can include:
considering whether a Data Protection Impact Assessment (DPIA) is required for new or changed processing involving personal data;
applying data minimisation when deciding what personal data needs to be collected and used; and
considering retention, review and deletion requirements when designing or selecting systems, including whether those systems can support the organisation’s retention arrangements.
Data minimisation
As discussed in Part One, data minimisation requires personal data to be adequate, relevant and limited to what is necessary for the purposes for which it is processed. In the context of retention, this means considering whether information that was necessary when collected remains needed over time.
In practice, this can include:
collecting only the personal data needed for the identified purpose;
periodically reviewing personal data to determine whether there is a continuing reason to retain it; and
considering whether information can be securely deleted or, where appropriate, effectively anonymised when identifiable personal data is no longer required.
Data governance
Data retention should form part of the organisation’s wider approach to data governance. Clear governance arrangements can clarify who is responsible for different categories of information, how retention decisions are made, and how those decisions are implemented and reviewed.
Depending on the organisation, this can include:
clear ownership and responsibilities for different categories of information;
documented policies, retention schedules, processes and procedures;
appropriate review and assurance arrangements;
mechanisms for identifying changes that may affect retention requirements; and
appropriate training and guidance for people responsible for creating, using, storing or disposing of information.
Together, these principles can support a more structured approach to data retention. The next step is to translate that approach into practical arrangements for identifying information, determining retention periods, documenting responsibilities and managing information throughout its lifecycle.
Developing a Data Retention Framework
The form of a data retention framework will vary depending on the organisation’s activities, the information it holds, and the legal, regulatory, and operational requirements that apply. It may include an overarching data retention policy, a detailed retention schedule and supporting processes or procedures.
The framework should be proportionate to the organisation and sufficiently clear for the people responsible for applying it. More complex organisations may need additional documentation or arrangements for particular functions, systems or categories of information.
The following steps illustrate some of the practical work involved in developing and maintaining a data retention framework.
Inventory Your Data
A useful starting point is to understand what information the organisation holds and where it is located. The level of detail required will depend on the organisation, but the exercise can include:
identifying categories of records and information held across the organisation;
recording where that information is stored, including relevant systems, shared drives, physical records and third-party services;
identifying the business function or record owner responsible for the information;
understanding the purpose for which the information is created, collected or retained;
identifying whether the records contain personal data or other information requiring particular handling; and
identifying existing retention periods or disposal arrangements, including areas where these are unclear or inconsistent.
Determine and document retention periods
Once record categories have been identified, the organisation can determine the appropriate retention period for each category. This can involve:
identifying applicable legal, regulatory, contractual or sector-specific requirements;
considering the purpose for which the information is held and how long it is needed for that purpose;
considering relevant limitation periods, operational requirements or other legitimate reasons for retention;
obtaining Legal, Data Protection or other specialist input where the appropriate period is unclear;
documenting the agreed retention period and the basis on which it has been determined; and
specifying when the retention period begins, for example from the end of a financial year, termination of a contract or end of an employment relationship.
Establish review and disposal arrangements
A retention framework should explain what happens when information reaches the end of its scheduled retention period. Depending on the circumstances, this can include:
reviewing whether there is a continuing reason or requirement to retain the information;
identifying circumstances in which normal disposal should be suspended, such as relevant litigation, an investigation or another specific legal or regulatory requirement;
establishing appropriate methods for securely disposing of physical and digital records;
considering how information held in backups, archives, shared systems or third-party services will be managed;
assigning responsibility for reviewing and authorising disposal where appropriate; and
maintaining appropriate evidence of disposal where the organisation needs a record of what was disposed of, when and under whose authority.
Communicate responsibilities and provide training
A retention framework will only work effectively if the people responsible for applying it understand what is expected of them. Depending on their roles, this can include:
making policies, retention schedules and supporting guidance accessible to the people who need them;
clearly communicating responsibilities for retaining, reviewing and disposing of information;
providing appropriate training or guidance for people with specific information-management responsibilities;
ensuring relevant teams know how to identify and escalate exceptions, such as information that must be preserved beyond its normal retention period; and
updating communications or training when significant changes are made to the organisation’s retention arrangements.
Review and maintain the retention framework
Data retention arrangements should be kept under review so that they continue to reflect the information the organisation holds and the requirements that apply. This can include:
establishing an appropriate review cycle for the policy, retention schedule and supporting documentation;
identifying changes in legal, regulatory or sector-specific requirements that may affect retention periods;
reviewing the framework when systems, services, organisational activities or information-handling practices change;
checking whether agreed retention and disposal arrangements are operating as intended;
updating record categories, ownership and retention periods where necessary; and
recording significant changes and ensuring they are communicated to the relevant people.
These steps can help an organisation establish a structured retention framework, but the work does not end once the documentation is produced. The framework needs to be maintained as information, systems, organisational activities and applicable requirements change.
Key challenges in data retention
Developing the documentation is only part of the work involved in data retention. Organisations can encounter practical challenges when determining retention periods and applying them consistently across different records, systems and business activities.
Some common challenges are considered below.
Balancing different retention requirements
Different considerations can apply to the same category of information. Challenges can include:
identifying statutory, regulatory, contractual and sector-specific requirements that apply to particular records;
distinguishing between a minimum period for which information must be retained and the separate question of whether there is a continuing justification for retaining it for longer;
considering operational needs, relevant limitation periods and other legitimate reasons for retention alongside applicable data protection requirements; and
resolving situations where different requirements or proposed retention periods appear to conflict, obtaining specialist input where necessary.
Managing data across multiple systems and formats
Information may be duplicated or distributed across different systems, formats and locations, making consistent retention more difficult. Challenges can include:
identifying where records are held across business systems, shared drives, email accounts, cloud services, physical files and third-party platforms;
understanding whether different systems can support the required retention, review and disposal arrangements;
identifying duplicate information and determining which copy constitutes the appropriate organisational record;
managing different versions of documents and establishing which versions need to be retained;
ensuring that retention arrangements take account of information held by third-party service providers where relevant; and
maintaining clear ownership where information crosses departmental or system boundaries.
Keeping the framework current
Retention arrangements can become outdated as an organisation and the requirements applying to it change. Keeping the framework current can involve:
identifying changes in legislation, regulation or sector-specific requirements that affect particular records;
considering new or updated guidance from relevant regulators or authorities;
reviewing retention arrangements when the organisation introduces new systems, services or ways of working;
considering whether organisational changes create new categories of information or alter existing responsibilities;
identifying additional requirements where information is subject to laws or regulatory regimes in other jurisdictions; and
ensuring that relevant changes are reflected consistently across the policy, retention schedule and supporting processes or procedures.
These challenges demonstrate why data retention should be treated as an ongoing information-management activity rather than a one-off documentation exercise. Clear ownership, periodic review and coordination between relevant teams can help keep the framework aligned with the organisation’s activities and applicable requirements.
Practical support with data retention
Data retention projects can require input from different parts of an organisation, particularly where information is held across multiple teams, systems and locations. Corporate Assist can provide additional capacity through our Compliance & Risk Support to help coordinate this work and bring structure to the information and documentation involved.
Corporate Assist can support the practical information-gathering and coordination involved in a data retention project. This can include helping to identify categories of records and where they are held, consolidating information provided by different teams, documenting existing retention arrangements and identifying gaps, inconsistencies or areas requiring further review.
We can also support the development and maintenance of data retention policies, retention schedules and supporting processes and procedures, using requirements and retention decisions agreed by the organisation and its relevant advisers. This can include bringing existing information into a consistent format, recording responsibilities and review arrangements, and helping to track updates where changes are identified.
As explored in this two-part series, effective data retention requires organisations to understand what information they hold, why it is retained, which requirements apply and when it should be reviewed or disposed of. Clear, well-maintained documentation can help bring these elements together and support a consistent approach across the organisation.
If your organisation needs additional capacity for a data retention project, get in touch to discuss your requirements.
Share this post: