3 steps to decide your data retention periods

Both UK and EU data protection law requires organisations to not keep personal data any longer than necessary for the purpose(s)s the data is processed for. Sounds simple, doesn’t it?

In practice, it’s one the most challenging areas of the law to comply with. How do businesses decide on justifiable retention periods? How do they implement retention periods in practice? And, crucially, what are the risks if they get it wrong?

In our experience it’s not uncommon for many businesses to be holding onto unnecessary personal data. So when deciding how long personal data should be kept, it’s helpful to work through the following key steps.

1. Does the law tell us how long to retain certain records?

Sometimes there will be a legal or statutory requirement to retain personal data for certain purposes. This is the easy bit, as you can use this to set retention periods for certain categories of data.

For example, your business may be subject to laws relating to employment and finance which give specific periods when you process people’s data for these purposes.

There may also be a duty to preserve documents for disclosure in legal proceedings that may have started or may be started in future.

2. Are there industry standards, guidelines or known good practice?

In regulated sectors such as finance, health and manufacturing there may be agreed industry standards or agreed professional practices which recommend and/or can justify retention periods. Working to best practice and precedent makes things much easier.

3. What about… everything else?

Okay, you’ve established for certain dataset and what you use that data for, there’s no statutory requirements. Maybe you’ve also no industry standards that apply. What do you do now?

You’ll need to assess what’s necessary, proportionate and reasonable to retain. By its very nature, this is subjective; cases will often turn on their own merits. Ideally, you’ll want to be able to justify retention periods for different datasets.

Here are some of the questions you can ask to try and reach a defensible decision.

• What are the business drivers for retention?
• Does the product lifecycle have an effect on retention?
• Does your approach to pricing have an effect on retention?
• Can it be evidenced certain data is legitimately needed for a certain amount of time?
• Do you need to keep personal data to handle queries or complaints?
• How damaging would it be to the business to delete certain data?

To give an example, I know of a retailer which took the step of carrying out research into how often their customers purchased their products. Due to the sturdy nature of their products, the research clearly showed for many customers there was a gap of 3-4 years between purchases. This analysis was used as justification for retaining customer details for postal marketing longer than perhaps another company might.

What are the risks?

Businesses expose themselves to a number of risks if they keep personal data for longer than necessary, or indeed don’t keep it long enough.

Information security risks

The impact of a data breach could be significantly worse; with a larger volume of records and more people affected. Enforcement action could be more severe if it becomes clear personal data has been kept with no justifiable reason, i.e. a Regulator might deem that older data was unlawfully held. It could also increase the likelihood of complaints from individuals asking why their data was kept for so long.

I once received an email from a major UK brand informing me that my data had been involved in a data breach. My first thought was how on earth does this company still have information about me? I couldn’t remember when I’d last bought anything from them.

Legal risks

Where there’s a statutory requirement for personal data to be retained for a specific period, there’s clearly a risk if records aren’t kept for the statutory period.

Contractual risks

Certain personal data may need to be kept to meet contractual terms; for example to provide a service or warranties. Not keeping certain data long enough may lead to an inability to respond to complaints, litigation or regulatory enforcement.

Customer expectations

Customers expect organisations to be able to respond to their needs. For example, answering queries or responding to complaints. Data about them therefore needs to be kept long enough to meet customers’ reasonable expectations. However, once a reasonable period has elapsed a customer may not expect you to be continuing to hold their details.

All these risks could also result in reputational damage for an organisation which fails to meet its legal obligations, contractual obligations, or their customers’ expectations.

We’d recommend all businesses have a straightforward retention policy and keep a retention schedule. Admittedly these are only the first steps. Actually implementing and deleting data when it comes to the end of its retention period can be the biggest challenge. We’d suggest you review your data at least annually and cleanse.

Using the old adage ‘you can only eat an elephant one bite at a time’, we’d advise focusing on the biggest risk areas. What data represents the biggest risk if you keep it too long?

Our detailed Data Retention Guide is full of further tips, case studies and sample retention schedules.