Data Protection and Storage Limitation Guide

This document has been updated for compatibility with the UK GDPR. It is ready for use from the start of 2021.

One of the core principles of the UK GDPR is the storage limitation principle. This principle means that you must not retain personal data for any longer than you need it in light of the purpose or purposes for which it was originally obtained.

Complying with this principle requires you to determine suitable retention periods for all personal data collected, held, and processed by your organisation. Some of these periods will be pre-determined by law, but many will not be. You must, therefore, think carefully about how long you will truly need personal data and keep track of it once you have it. Reviewing your retention of that data after acquiring it will also be important.

When you decide personal data is no longer needed, it must be deleted or otherwise disposed of, or rendered ‘non-personal’ using a suitable anonymization process.

These Data Retention Guidance Notes have been designed to explain the UK GDPR’s storage limitation principle in more detail, including how that principle ties in with other key elements of data protection law. Practical tips are also offered on compliance, particularly with regard to the safe deletion and/or disposal of personal data that is no longer needed, both in electronic and hardcopy forms.

Reference is also made in this document to a Data Retention Policy. To download our Data Retention Policy template, please click here.

These Data Retention Guidance Notes contain the following parts:

Introduction
1. Purpose and Lawful Basis
2. Data Minimization
3. Keeping Data Accurate and Up-to-Date
4. Storage Limitation
5. After the Retention Period
6. Conclusions

Once you have purchased access to the appropriate document folder click on the “Download Document” link below. You will be asked what you want to do with the file. It is recommended that you save the document to a location of your choice prior to viewing.