Purpose and Scope
This policy sets retention periods for business records and personal information at [Organisation Name] and details requirements for secure disposal. It applies to all records regardless of format, including databases, physical files, email, shared drives, backup media, and archives. It covers all staff who create, manage, or store company data.
Working through related paperwork at the same time? See also our UK Data Retention & Disposal Policy Template, Data Protection Policy Template and UK Data Breach Response Procedure Template.
Policy Statement
[Organisation Name] keeps records only as long as needed for documented business, legal, or regulatory reasons. Staff must maintain records according to the schedule in this policy and destroy them securely when the retention period ends. Staff must not keep unauthorized personal copies, local exports, or secondary spreadsheets outside designated systems of record.
Responsibilities
- Policy Owner ([Role]): Maintains this policy, updates the retention schedule, and issues or lifts legal holds.
- Record Owners ([Role]): Applies retention periods to records in their operational areas and carries out routine record disposal.
- All Staff: Stores business records in designated systems of record instead of local drives or personal accounts, and flags unclassified or ownerless records for review.
Determination of Retention Periods
We set retention periods based on four criteria:
- Legal and Regulatory Requirements: Retain records subject to statutory timelines, such as tax and financial documents, according to official tax and regulatory guidance. Document the statutory basis in the retention schedule.
- Limitation Periods for Potential Claims: Retain records needed to defend or prosecute legal claims for periods that match applicable statutory limitation windows.
- Operational Requirements: Retain records needed for daily operations only while active business need exists. Document the justification in the retention schedule.
- Anonymisation: When keeping records strictly for long-term statistics or analysis, strip all personal identifiers permanently instead of storing identifiable data.
Retention Schedule
- Financial and Tax Records: Keep for [Period] per applicable official tax authority guidance.
- Payroll and Employment Records: Keep for [Period] per statutory federal, state, or local employment regulations.
- Recruitment Records (Including Non-Hired Candidates): Keep for [Period] after completing the hiring process.
- Customer Account and Transaction Records: Keep for [Period] after ending the business relationship.
- Marketing Data and Prospect Lists: Keep for [Period] after the last recorded contact.
- Incident, Safety, and Insurance Records: Keep for [Period] after the incident or policy expiration.
- Security Camera Footage: Keep for [Period], unless held for a security incident or legal hold.
- Email and General Correspondence: Keep for [Period], unless filed in a system of record under a specific category.
Use our templates to fast-track your documentation
Customize this template and 100s of others for free in Whale, the fastest way to get your team aligned.
Secure Disposal Standards
- Paper Records: Shred using cross-cut shredders or dispose via an authorized confidential waste vendor ([Service Provider]). Never throw business papers in standard trash bins.
- Digital Records: Delete files from live systems of record and secondary storage locations. The designated [Role] must verify deletion.
- System Backups: Let backup data expire naturally through standard backup rotation cycles. Do not restore expired backup data to active systems.
- Hardware and Storage Media: Have a certified vendor ([Service Provider]) sanitize or physically destroy retired hardware and storage media. Keep all certificates of destruction.
- Consumer and Background Data: Dispose of consumer report information and personal data strictly according to data protection regulations.
- Third-Party Vendors: When a contract ends, the designated [Role] must get written confirmation from the vendor that company data was deleted or returned.
- Disposal Logs: Log all mass disposals or category-wide deletions. Record the category, date, volume, and responsible person.
Legal Holds
- When litigation, administrative proceedings, audits, or government investigations are active or anticipated, the [Role] issues a formal legal hold notice.
- Upon receiving a legal hold notice, stop all routine disposal immediately for records in scope.
- The [Role] notifies affected record owners in writing, detailing which records to preserve.
- The legal hold overrides the standard retention schedule until the [Role] formally lifts it in writing.
Operational Implementation Procedure
- Inventory all physical and digital storage locations, including server drives, software platforms, and paper filing systems.
- Assign a designated [Role] as Record Owner for every category in the retention schedule.
- Check retention timelines against legal requirements. Record the legal or operational justification for each row in the schedule.
- Run periodic disposal purges supervised by Record Owners to clear expired files.
- Align internal retention schedules with public privacy notices so disclosures match actual practice.
Records and Review
Store retention schedules, destruction logs, and legal hold notices in [System/Location]. Review this policy and its schedule [Frequency], or whenever major operational shifts, system implementations, or regulatory changes occur.
- Policy Owner: [Role]
- Next Review Date: [Date]
FAQs on a data retention policy
What is a data retention policy?
A data retention policy sets retention periods for business records and personal information at your organisation and details requirements for secure disposal. It applies to all records regardless of format, including databases, physical files, email, shared drives, backup media, and archives.
Having it written down means the same rules apply to everyone, so managers are not making judgement calls case by case under pressure.
What does a data retention policy include?
This template covers determination of retention periods, retention schedule, secure disposal standards and legal holds.
Every section is written to be filled in. The bracketed placeholders mark the decisions that are yours to make, such as timescales, approval owners and retention periods.
How to implement a data retention policy with Whale
Copy this template into Whale and work through the bracketed placeholders so it reflects how your organisation actually operates.
Assign it to the teams it applies to so it sits where people work rather than in a shared drive, and set a review date so it gets revisited on schedule instead of quietly going out of date.
Use our templates to fast-track your documentation
Customize this template and 100s of others for free in Whale, the fastest way to get your team aligned.