Data retention policy

The law requires a business to keep personal data no longer than it needs it, the privacy notice promises retention periods, and the regulator asks for the policy that shows the business decided what those periods are and applies them. A retention policy is the schedule of record types, the period for each, the reason (a statute, a limitation period, a business need), the method of deletion and the exceptions for disputes, with an owner and a review date, written so that staff can follow it rather than filed and forgotten. I draft the retention policy with the data processing agreement and the privacy notice for the business for a fixed fee of £795, delivered in five working days, with a note on the operational steps the documents assume.

Who this is for

Businesses in England and Wales with customer, staff, supplier and marketing records in systems and cupboards that have never been cleared, and businesses whose privacy notice states periods nobody has ever applied.

What matters in a data retention policy

Storage limitation and why a policy is the evidence

Article 5(1)(e) of the UK GDPR requires personal data to be kept in a form that permits identification for no longer than is necessary for the purposes, Article 5(2) requires the controller to be able to demonstrate compliance, and Article 13 requires the privacy notice to state the retention period or the criteria used to set it, so that a business needs to have decided its periods, told people what they are, and applied them; the retention policy is where the decision is recorded, and a business that is asked by the regulator or by a subject access request why it still holds a customer's records from a decade ago answers from the policy or does not answer at all.

The schedule, the periods and where they come from

The policy's core is a schedule listing each category of record the business holds (customer accounts and orders, enquiries that went nowhere, contracts and correspondence, marketing lists, staff files, payroll, recruitment, health and safety, CCTV, website and system logs, supplier records, accounts and tax, insurance, complaints and disputes), the system or location where each is held, the retention period, the trigger that starts it (the end of the contract, the end of employment, the end of the tax year, the date of the record), the reason, and the method of disposal; the schedule is drafted from the business's actual records rather than from a generic list, which is why the note that comes with the documents asks the business to walk through what it holds.

The periods the law sets and the periods the business chooses

Some periods are set by law: accounting records under section 388 of the Companies Act 2006 (three years for a private company, six for a public one, with HMRC requiring six years for VAT and tax records), PAYE records for three years after the tax year, working time records for two years under the Working Time Regulations 1998, accident records for three years under the Reporting of Injuries, Diseases and Dangerous Occurrences Regulations 2013, right to work evidence for two years after employment ends, and the periods professional bodies and regulators impose; most periods are the business's own choice, justified by the limitation period for claims (six years for contract under the Limitation Act 1980, twelve for a deed, three for personal injury, with discrimination claims much shorter), by the relationship (the customer who returns), or by the purpose, and the policy states the reason for each so that the choice can be defended.

Deletion, backups and the data that is harder to delete than to keep

The policy should say how each category is deleted (deleted from the live system, shredded, anonymised where the business wants the statistics without the person), who does it and when (a periodic run rather than a one-off purge), how backups are handled (data deleted from the live system remains in backups until the cycle overwrites them, which the policy and the privacy notice should say), how data in email, shared drives, personal devices and paper is caught (which is where retention fails), and how the business deals with systems that cannot delete (a SaaS tool with no deletion function is a reason to change tool); a policy that states periods the systems cannot enforce describes an intention rather than a practice.

Legal holds, disputes and the record that must not be deleted

The policy should provide that where a claim, a complaint, a regulatory enquiry, a subject access request or litigation is reasonably anticipated, the records relevant to it are placed on hold and the retention period is suspended, because deleting records that are relevant to anticipated proceedings is a breach of the duty to preserve documents and, where a request is in progress, an offence under section 173 of the Data Protection Act 2018 where it is done to prevent disclosure; the hold is lifted when the matter closes, the records are then deleted on the schedule, and the policy names who can impose and lift a hold.

Ownership, review and the policy that staff follow

The policy should name its owner, require an annual review and a review when the business starts a new activity or adopts a new system, be issued to staff with the data protection policy in the handbook, and be backed by the records of processing under Article 30 of the UK GDPR (which list the same categories and should state the same periods); the privacy notice drafted alongside states the periods the policy sets, the data processing agreement requires the business's processors to delete or return data on the business's instructions in line with the policy, and the note that comes with the documents lists the practical steps (the first clear-out, the recurring deletion runs, the backup cycle confirmed with the IT provider) that make the policy true.

What it costs

DPA and privacy terms, £795. Data processing agreement plus privacy notice. Five working days.

Review of a customer's DPA, £495. They sent theirs and you need to know what you are accepting. Returned marked up with the changes to ask for and an explanation. Three working days.

Email me at geoffrey@caesar.co.uk with what you need and any documents, and I will confirm the scope and the fee in writing, usually the same working day.

What you get

• A data processing agreement that meets the statutory requirements and can be used as a schedule to your main contract
• A privacy notice written for people to read rather than to be scrolled past
• Clear allocation of controller and processor roles, which is where most confusion starts
• International transfer provisions where you use overseas suppliers
• Sub-processor and security provisions proportionate to what you do
• A note on the operational steps the documents assume you are taking

What is not included

• Full compliance audits and data mapping exercises
• ICO registration, which you do yourself
• Breach response and regulatory correspondence
• Cyber security certification such as Cyber Essentials
• Advice on data protection law outside the UK and EU

Questions I am often asked

Our privacy notice says we keep data 'as long as necessary'. Is that enough?

No: the notice must state the period or the criteria, and the business must have decided them. The retention policy is where the decision is made and recorded, and the notice is updated to match.

How long should we keep customer records?

Long enough for the contract, the limitation period for claims (six years for most contracts) and the tax records the law requires, then deleted, with enquiries that went nowhere deleted much sooner. The schedule states the period and the reason for each category.

Can we delete records when a customer complains?

Not the records relevant to the complaint: they go on hold until the matter closes, and deleting them to avoid disclosure is an offence where a request is in progress. The policy provides for holds and names who imposes them.

Related guidance and services

• Data protection agreements and privacy terms, £795, the service this page describes
• SaaS and technology contracts, £995
• Terms and conditions drafting, £995
• Records of processing for a small business
• Subject access request procedure

This page is general guidance for businesses in England and Wales, not advice on your own circumstances. Last reviewed: October 2026. Email geoffrey@caesar.co.uk.