A free UK-aligned template covering 4 essential clauses. Edit the highlighted fields, sign, and adopt.
| Document owner | [Insert role — typically Data Protection Officer, Head of Compliance, or Company Secretary] |
|---|---|
| Approved by | [Insert name and date of board / management approval] |
| Version | 1.0 |
| Date of issue | [DD Month YYYY] |
| Review cycle | Annually, or upon material change to statutory retention obligations |
| Classification | Internal — All Employees |
| Applies to | All personal data and business records processed by [Company], in any format |
This policy sets out the principles and arrangements under which [Company] determines how long personal data and business records are retained, and how they are securely disposed of when that retention period ends. The objective is to comply with the storage-limitation principle in Article 5(1)(e) of the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, applicable statutory retention rules (HMRC, ACAS, Companies Act 2006, Limitation Act 1980), and reasonable evidential needs for actual or anticipated litigation.
This policy applies to:
This policy operates in conjunction with [Company]'s Information Security Policy, Data Protection Policy, and Subject Access Request Procedure. Where this policy conflicts with a statutory retention obligation, the statutory obligation prevails and the schedule is updated accordingly.
Retention decisions are made by reference to documented principles, not custom or convenience. The ICO accountability framework requires controllers to evidence that retention periods are justified, applied consistently, and reviewed at appropriate intervals.
Personal data is retained only for as long as necessary for the purposes for which it was collected. Where the original purpose ends and no further lawful basis applies, the data is deleted, anonymised, or transferred to a restricted archive in accordance with the schedule in Section 3.
Where statute requires retention for a defined period — for example HMRC PAYE regulations (seven years), the Companies Act 2006 (six years for accounting records), the Limitation Act 1980 section 5 (six years for simple contract claims), or sector-specific rules under FCA, Ofcom or the Health and Safety Executive — the statutory period takes precedence over any shorter operational preference.
Records that may evidence an actual or anticipated legal claim are retained for the relevant limitation period, plus a buffer to allow for late discovery. The default limitation period under English law is six years from the cause of action accruing; longer periods apply to specialty contracts (twelve years) and to claims involving personal injury (three years) or fraud.
Every retention period in Section 3 has a documented justification — purpose, lawful basis, statutory cite, or limitation-period reference. The schedule is reviewed annually, or sooner when a relevant statute changes. The documented justification is what the ICO accountability framework expects in the event of an audit or complaint.
The following schedule sets the default retention period for the most common categories of records [Company] holds. Where a specific record falls outside these categories, the Data Protection Officer (or equivalent) shall apply the principles in Section 2 and add the new category to the schedule on the next annual review.
The full audit-ready policy expands this schedule to 30+ named categories, each with a primary-source statutory cite, the documented justification, and the trigger event from which the retention clock starts. See the upsell block at the end of this document for details.
"Defensible deletion" means deletion the controller can document, evidence and defend if challenged. Silent ad-hoc purging creates worse evidential problems than overretention. This section sets out the operational requirements that turn a retention schedule into actual deletion you can defend.
Deletion is triggered by the schedule in Section 3, not by individual judgement. The Data Protection Officer reviews scheduled deletions on a [monthly/quarterly] basis and signs off the batch before execution. Ad-hoc deletion of records that fall within the schedule's retention period requires written approval from the DPO and a documented justification.
For every deletion, [Company] retains a deletion record showing: the category of record, the volume deleted, the deletion method, the date, and the authorising role. The deletion record itself is retained for six years.
Where [Company] receives a letter of claim, regulatory information notice (ICO, FCA, HMRC, HSE), Part 31 disclosure obligation, or other formal trigger, scheduled deletion of relevant records is suspended until the hold is lifted by the General Counsel (or equivalent). The full audit-ready policy contains the legal-hold trigger taxonomy, the suspension notification template, the chain-of-custody requirements, and the hold-release procedure — see the upsell block at the end of this document.
This free version covers four foundational clauses. The full £49.99 single-policy version adds the full statutory schedule (30+ data categories with primary-source citations), the legal-hold procedure with trigger taxonomy and chain-of-custody language, the anonymisation-vs-pseudonymisation decision tree, the ICO 72-hour breach trigger for retention failures, and an employee acknowledgement form. Editable Word + PDF, instant download, lifetime access, no subscription.
Buy the full policy — £49.99 →