Retention policies or retention schedules list the types of record or information you hold, what you use it for, and how long you intend to keep it. They help you establish and document standard retention periods for different categories of personal data.

A retention schedule may form part of a broader ‘information asset register’ (IAR), or your general processing documentation.

To comply with [documentation requirements](/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/documentation/), you need to establish and document standard retention periods for different categories of information you hold wherever possible. It is also advisable to have a system for ensuring that your organisation keeps to these retention periods in practice, and for reviewing retention at appropriate intervals. Your policy must also be flexible enough to allow for early deletion if appropriate. For example, if you are not actually using a record, you should reconsider whether you need to retain it.

If you are a small organisation undertaking occasional low-risk processing, you may not need a documented retention policy.

However, if you don’t have a retention policy (or if it doesn’t cover all of the personal data you hold), you must still regularly review the data you hold, and delete or anonymise anything you no longer need.

**Further reading – records management and retention schedules**

- [The National Archives (TNA)](http://www.nationalarchives.gov.uk/information-management/) publishes practical guidance for public authorities on a range of records management topics, including retention and disposal. This guidance can help you comply with the storage limitation principle (even if you are not a public authority):
- [Disposing of records](http://www.nationalarchives.gov.uk/information-management/manage-information/policy-process/disposal/)
- [FOI Records Management Code – Guide 8: Disposal of records](https://www.nationalarchives.gov.uk/information-management/manage-information/planning/records-management-code/)
- [The Keeper of the Records of Scotland](https://www.nrscotland.gov.uk/about-us) also publishes guidance on Scottish public authorities’ records management obligations, including [specific guidance on retention schedules](https://www.gov.scot/publications/scottish-government-records-management-plan-2/pages/8/).

###

The UK GDPR does not dictate how long you should keep personal data. It is up to you to justify this, based on your purposes for processing. You are in the best position to judge how long you need it.

You must also be able to justify why you need to keep personal data in a form that permits identification of individuals. If you do not need to identify individuals, you should anonymise the data so that identification is no longer possible.

For example:

- You should consider your stated purposes for processing the personal data. You can keep it as long as one of those purposes still applies, but you should not keep data indefinitely ‘just in case’, or if there is only a small possibility that you will use it.

**Example**

A bank holds personal data about its customers. This includes details of each customer’s address, date of birth and mother’s maiden name. The bank uses this information as part of its security procedures. It is appropriate for the bank to retain this data for as long as the customer has an account with the bank. Even after the account has been closed, the bank may need to continue holding some of this information for legal or operational reasons for a further set time.

**Example**

A bank may need to retain images from a CCTV system installed to prevent fraud at an ATM machine for several weeks, since a suspicious transaction may not come to light until the victim gets their bank statement. In contrast, a pub may only need to retain images from their CCTV system for a short period because incidents will come to light very quickly. However, if a crime is reported to the police, the pub will need to retain images until the police have time to collect them.

**Example**