GDPR Q41
What is a retention policy under GDPR?
Q41. What is a retention policy under GDPR?
Category: Retention
A retention policy sets rules for how long you keep different types of personal data and how you dispose of it when time is up.
In simple terms
- Define retention periods for each record type.
- Explain deletion or anonymisation methods.
- Review the policy regularly to keep it relevant.
Creating the policy
List your record types, identify legal requirements, and agree business needs. Document retention periods and responsible owners.
- Use tables grouping records by department or process.
- Include references to statutory retention periods where applicable.
- Plan for exceptional circumstances when data must be kept longer.
Implementing retention
Explain how data will be reviewed, deleted, or anonymised. Cover digital and paper records, archives, and backups.
- Assign tasks and reminders to trigger reviews.
- Specify secure disposal methods, such as shredding or certified destruction.
- Record deletion activities for accountability.
Practical steps to take
- Compile a list of records, purposes, and legal retention obligations.
- Set retention periods and document rationale.
- Publish the policy and train staff on their responsibilities.
- Automate deletion where systems allow and monitor completion.
- Audit compliance and update schedules when laws or processes change.
Real-life examples
Finance policy
An organisation keeps invoices for six years to meet tax obligations, then destroys them securely.
Customer records
A SaaS provider deletes dormant accounts after 24 months and anonymises usage analytics.
Helpful reminders
- Inform staff about legal holds that pause deletion during investigations.
- Apply retention rules to backups and email archives.
- Keep evidence that reviews took place.
Key takeaway
A clear retention policy keeps data tidy, lawful, and easier to manage.
Article references
Further reading
Have we made a mistake, or an error or omission? Email support@akadata.ltd so we can correct it quickly.