Purpose and Scope
This policy sets out operational requirements for retaining and securely disposing of personal data within [Organisation Name]. It covers all record formats, including electronic databases, digital files, emails, paper documents, backups, and archives. It applies to all staff who create, manage, or store company data.
Working through related paperwork at the same time? See also our US Data Retention Policy Template, UK Data Breach Response Procedure Template and US Data Breach Response Procedure Template.
Policy Statement
[Organisation Name] retains personal data only as long as required for documented operational, legal, or regulatory reasons. Hold data according to the retention schedule in this policy, and destroy it securely once the retention period ends. Do not keep personal copies, local exports, or unapproved shadow spreadsheets outside official systems of record.
Responsibilities
- Policy Owner ([Role]): Maintains this policy and the retention schedule, monitors compliance, and issues or lifts legal holds.
- Record Owners ([Role]): Apply the retention schedule to records in their operational areas and run routine data disposals.
- All Staff: Store all records in designated systems of record rather than local drives. Report unassigned or unscheduled records to the Policy Owner.
Retention Criteria
We base retention periods on four criteria:
- Legal and Regulatory Requirements: Retain records governed by statutory rules (such as tax, payroll, and health and safety) aligned with current official guidance.
- Potential Legal Claims: Retain records needed to defend or bring legal claims for the full statutory limitation period.
- Operational Need: Retain records without statutory limits only while actively needed for documented business use.
- Anonymisation: Strip personal identifiers permanently if data is needed strictly for long-term statistical use instead of full destruction.
Retention Schedule
- Customer Accounts and Transaction Records: Retained for [Period] following the termination of the customer relationship. Reason/Source: [Insert Justification/Legal Reference].
- Enquiries and Prospect Data: Retained for [Period] following the last recorded contact. Reason/Source: [Insert Justification/Legal Reference].
- Financial, Tax, and Payroll Records: Retained for [Period] in accordance with statutory tax regulations. Reason/Source: [Insert Justification/Legal Reference].
- Staff Records: Retained for [Period] following the end of employment. Reason/Source: [Insert Justification/Legal Reference].
- Unsuccessful Applicant Records: Retained for [Period] following the recruitment decision. Reason/Source: [Insert Justification/Legal Reference].
- Accident and Incident Records: Retained for [Period]. Reason/Source: [Insert Justification/Legal Reference].
- Closed-Circuit Television (CCTV) Footage: Retained for [Period], unless preserved in connection with a reported incident or investigation. Reason/Source: [Insert Justification/Legal Reference].
- Emails and General Correspondence: Retained for [Period] or managed via automated archiving schedules, unless classified under a specific record category. Reason/Source: [Insert Justification/Legal Reference].
Use our templates to fast-track your documentation
Customize this template and 100s of others for free in Whale, the fastest way to get your team aligned.
Secure Disposal Procedure
- Physical Records: Cross-cut shred paper files containing personal data on-site, or place them in designated confidential waste bins for secure destruction by [Disposal Service Provider]. Never use standard trash or recycling.
- Digital Records: Permanently delete electronic files from primary storage systems and shared repositories. Record Owners must verify deletion. Backups will expire and overwrite deleted data following standard backup cycles.
- Hardware Decommissioning: Send retired storage devices and media to [Certified Provider] for certified data wiping or physical destruction. Keep all destruction certificates on file.
- Third-Party Vendor Contracts: When ending a contract with a third-party service provider, [Role] must get written confirmation that all company data was deleted or returned.
- Disposal Logging: Log every destruction run of full record classes. Record the record class, date of disposal, and authorizing individual.
Legal Hold Procedure
- When litigation, an investigation, a formal complaint, or a subject access request is active or expected, [Role] issues a formal legal hold.
- Once a written legal hold notice arrives, stop routine destruction immediately for all affected records.
- A legal hold overrides the standard retention schedule until [Role] issues a written release lifting it.
Policy Implementation
- Inventory all physical and digital storage repositories across the organisation.
- Document the legal rationale and source for every retention period in the schedule.
- Check all statutory retention periods against current regulatory guidance.
- Assign a Record Owner to each category in the retention schedule.
- Run an initial supervised disposal to clear legacy data backlogs.
- Align the retention schedule against internal and external privacy notices.
Records and Review
Store the retention schedule, disposal logs, and legal hold notices at [System/Location].
Review this policy and its schedule on a [Review Frequency] basis. Triggers for an earlier review include deploying new software systems, changing record processing activities, or updates to legal obligations.
- Policy Owner: [Role]
- Next Review Date: [Date]
FAQs on a data retention and disposal policy
What is a data retention and disposal policy?
A data retention and disposal policy sets out operational requirements for retaining and securely disposing of personal data within your organisation. It covers all record formats, including electronic databases, digital files, emails, paper documents, backups, and archives.
Having it written down means the same rules apply to everyone, so managers are not making judgement calls case by case under pressure.
What does a data retention and disposal policy include?
This template covers retention criteria, retention schedule, secure disposal procedure and legal hold procedure.
Every section is written to be filled in. The bracketed placeholders mark the decisions that are yours to make, such as timescales, approval owners and retention periods.
How to implement a data retention and disposal policy with Whale
Copy this template into Whale and work through the bracketed placeholders so it reflects how your organisation actually operates.
Assign it to the teams it applies to so it sits where people work rather than in a shared drive, and set a review date so it gets revisited on schedule instead of quietly going out of date.
Use our templates to fast-track your documentation
Customize this template and 100s of others for free in Whale, the fastest way to get your team aligned.