Data Retention

1. Introduction

1.1. During carrying out its various functions, we create and hold a wide range of recorded information. Records need to be properly retained to enable us to meet out business needs, legal requirements, to evidence events or agreements in the event of allegations or disputes and to ensure that any records of historic value are preserved.

1.2. The untimely destruction of records could affect:

1.2.1. the conduct of our business;
1.2.2. our ability to defend or instigate legal actions;
1.2.3. our ability to comply with statutory obligations;
1.2.4. our reputation.

1.3. Conversely, the permanent retention of records is undesirable, and disposal is necessary to free up storage space, reduce administrative burden and to ensure that we do not unlawfully retain records for longer than necessary (particularly those containing personal data).

1.4. This policy supports us in demonstrating public accountability through the proper retention of records and by demonstrating that disposal decisions are taken with proper authority and in accordance with due process.

2. Purpose

2.1. The purpose of this policy is to set out the length of time that our records should be retained and the processes for disposing of records at the end of the retention period.

2.2. The policy helps to ensure that we operate within the applicable regulatory framework.

3. Scope

3.1. The policy covers the records listed in the schedule hereto irrespective of the media on which they are created or held including:

3.1.1. paper;
3.1.2. electronic files (including database, Word documents, powerpoint presentations, spreadsheets, webpages and e-mails);
3.1.3. photographs, scanned images, CD-ROMS and video tapes.

3.2. The Schedule aims to include all types of records which we create or hold. They include:

3.2.1. minutes of meetings;
3.2.2. submissions from external parties;
3.2.3. contracts and invoices;
3.2.4. registers;
3.2.5. legal advice;
3.2.6. file notes;
3.2.7. financial accounts;
3.2.8. employee information;
3.2.9. our publications.

3.3. Should you become aware of any records missing from the Schedule, please notify the Data Protection Manager so that they may be added at the next opportunity.

4. Application

4.1. The policy applies equally to full time and part time employees on a substantive or fixed-term contract and to associated persons who work for us such as agency staff, contractors and others employed under a contract of service.

4.2. Directors are responsible for ensuring that this policy is applied within the departments. The Data Protection Manager has lead responsibility for records management.

5. Minimum Retention Period

5.1. Unless a record has been marked for ‘permanent preservation’ it should only be retained for a limited period. Records that are marked for ‘permanent preservation’ should only be held by us for a total of 30 years before being destroyed.

5.2. A recommended minimum retention period is provided for each category of record in the Schedules attached. The retention period applies to all records within that category. The recommended minimum retention period derives from either:

5.2.1. business need as determined by the Directors;
5.2.2. legislation;

6. Disposition

6.1. What is Disposition?

6.1.1. Directors are responsible for ensuring that the Schedules are periodically reviewed (at least annually) to determine whether any retention periods applying to records within their directorates have expired. Once the retention period has expired, the record must be reviewed and a ‘disposition action’ agreed upon.

6.1.2. A ‘disposition action’ is either:

6.1.2.1. the destruction of the record;
6.1.2.2. the retention of the record for a further period

Each of these options is described further below.

6.2. Making and Recording the Disposition Decision

6.2.1. A review of the record should take place as soon as possible after the expiry of the retention period or, if that is not feasible, the record should be retained and a later review date set. It need not be a detailed or time-consuming exercise but there must be a considered appraisal of the contents of the record. The review should be conducted by the relevant Director (or their delegate) in consultation with relevant stakeholders for example:

6.2.1.1. other senior managers;
6.2.1.2. Head of IT;
6.2.1.3. relevant external bodies;
6.2.1.4. legal adviser.

6.2.2. The disposition decision must be reached having regard to:

6.2.2.1. on-going business and accountability needs (including audit);
6.2.2.2. current applicable legislation;
6.2.2.3. whether the record has any long term historical or research value;
6.2.2.4. best practice in the applicable professional field (for example human resources);
6.2.2.5. costs associated with continued storage versus costs of destruction;
6.2.2.6. the legal, political and reputational risks associated with keeping, destroying or losing control over the record.

6.3. Decisions must not be made with the intent of denying access or destroying evidence.

6.4. The agreed disposal decision must be recorded on a Record Disposal Form. The form is available from the Data Protection Manager and will require the following information:

6.4.1. Description of the record;
6.4.2. The medium on which it is held eg CD;
6.4.3. The directorate which created or held the record;
6.4.4. The date of the creation of the record and the date of review;
6.4.5. The disposal decision and the method of disposal;
6.4.6. A summary of the reasons for the decision;
6.4.7. The titles of the reviewers and officers consulted;
6.4.8. The signature of the person authorising disposal.

6.5. Completed forms must be passed to the Data Protection Manager for safekeeping.

7. Destruction

7.1. No destruction of a record should take place without assurance that:

7.1.1. the record is no longer required by any part of the business;
7.1.2. no work is outstanding by any part of the business;
7.1.3. no litigation or investigation is current or pending which affects the record;
7.1.4. there are no current or pending FOIA or DPA access requests which affect the record

7.2. Destruction of Paper Records. Destruction should be carried out in a way that preserves the confidentiality of the record. Non-confidential records i.e records that are clearly in the ‘public domain’ can be placed in ordinary rubbish bins or recycling bins. Confidential records should be shredded and placed in paper rubbish sacks for collection by an approved disposal firm. All copies including security copies, preservation copies and backup copies should be destroyed at the same time in the same manner.

7.3. Destruction of Electronic Records. All electronic records will need to be either physically destroyed (and a record of destruction certified) or wiped to the current Government standard. Deletion of the files is not sufficient. Destruction will be overseen by the Data Protection Manager.

8. Further retention

8.1. The record may be retained for a further period if it has on-going business value or if there is specific legislation which requires it to be held for a further period. Please check with the Data Protection Manager if there is any doubt as to how long a record should be retained under law.

8.2. A record should not ordinarily be retained for more than 30 years in aggregate from the date of creation.

Schedule

Unsuccessful Job Applicant records.1 yearFeedback to applicants. Possible consideration if successful candidate does not work out. Statutory limitation period for discrimination and other claims = 3 months