Article
Principle (e): Storage limitation | ICO
ico.org.uk
Quoted on this wiki
Every place a page here uses this source, in the order the words come in it.
Checklist “☐ We know what personal data we hold and why we need it.” ☐ We carefully consider and can justify how long we keep personal data.
You must not keep personal data for longer than you need it. “You need to think about – and be able to justify – how long you keep personal data. This will depend on your purposes for holding the data.” You need a policy setting standard retention periods wherever possible, to comply with documentation requirements.
You must carefully consider any challenges to your retention of data. Individuals have a right to erasure if you no longer need the data. “You can keep personal data for longer if you are only keeping it for public interest archiving, scientific or historical research, or statistical purposes.” Checklist
You need to think about – and be able to justify – how long you keep personal data. This will depend on your purposes for holding the data. “You need a policy setting standard retention periods wherever possible, to comply with documentation requirements.” You should also periodically review the data you hold, and erase or anonymise it when you no longer need it.
You need a policy setting standard retention periods wherever possible, to comply with documentation requirements. “You should also periodically review the data you hold, and erase or anonymise it when you no longer need it.” You must carefully consider any challenges to your retention of data. Individuals have a right to erasure if you no longer need the data.
You should also periodically review the data you hold, and erase or anonymise it when you no longer need it. “You must carefully consider any challenges to your retention of data.” You can keep personal data for longer if you are only keeping it for public interest archiving, scientific or historical research, or statistical purposes.
You should also periodically review the data you hold, and erase or anonymise it when you no longer need it. “Individuals have a right to erasure if you no longer need the data.” You can keep personal data for longer if you are only keeping it for public interest archiving, scientific or historical research, or statistical purposes.
Checklist “☐ We know what personal data we hold and why we need it.” ☐ We carefully consider and can justify how long we keep personal data.
You must not keep personal data for longer than you need it. “You need to think about – and be able to justify – how long you keep personal data. This will depend on your purposes for holding the data.” You need a policy setting standard retention periods wherever possible, to comply with documentation requirements.
You need to think about – and be able to justify – how long you keep personal data. This will depend on your purposes for holding the data. “You need a policy setting standard retention periods wherever possible, to comply with documentation requirements.” You should also periodically review the data you hold, and erase or anonymise it when you no longer need it.
You need a policy setting standard retention periods wherever possible, to comply with documentation requirements. “You should also periodically review the data you hold, and erase or anonymise it when you no longer need it.” You must carefully consider any challenges to your retention of data. Individuals have a right to erasure if you no longer need the data.
You should also periodically review the data you hold, and erase or anonymise it when you no longer need it. “Individuals have a right to erasure if you no longer need the data.” You can keep personal data for longer if you are only keeping it for public interest archiving, scientific or historical research, or statistical purposes.
At a glance “You must not keep personal data for longer than you need it.” You need to think about – and be able to justify – how long you keep personal data. This will depend on your purposes for holding the data.
You should also periodically review the data you hold, and erase or anonymise it when you no longer need it. “You must carefully consider any challenges to your retention of data.” You can keep personal data for longer if you are only keeping it for public interest archiving, scientific or historical research, or statistical purposes.
The UK GDPR does not dictate how long you should keep personal data. It is up to you to justify this, based on your purposes for processing. You are in the best position to judge how long you need it. “If you do not need to identify individuals, you should anonymise the data so that identification is no longer possible.” For example:
Why is storage limitation important? “Apart from helping you to comply with the data minimisation and accuracy principles, this also reduces the risk that you will use such data in error – to the detriment of all concerned.” Personal data held for too long will, by definition, be unnecessary. You are unlikely to have a lawful basis for retention.
At a glance “You must not keep personal data for longer than you need it.” You need to think about – and be able to justify – how long you keep personal data. This will depend on your purposes for holding the data.
You must not keep personal data for longer than you need it. “You need to think about – and be able to justify – how long you keep personal data. This will depend on your purposes for holding the data.” You need a policy setting standard retention periods wherever possible, to comply with documentation requirements.
You need to think about – and be able to justify – how long you keep personal data. This will depend on your purposes for holding the data. “You need a policy setting standard retention periods wherever possible, to comply with documentation requirements.” You should also periodically review the data you hold, and erase or anonymise it when you no longer need it.
Checklist “☐ We know what personal data we hold and why we need it.” ☐ We carefully consider and can justify how long we keep personal data.
You need a policy setting standard retention periods wherever possible, to comply with documentation requirements. “You should also periodically review the data you hold, and erase or anonymise it when you no longer need it.” You must carefully consider any challenges to your retention of data. Individuals have a right to erasure if you no longer need the data.
You should also periodically review the data you hold, and erase or anonymise it when you no longer need it. “Individuals have a right to erasure if you no longer need the data.” You can keep personal data for longer if you are only keeping it for public interest archiving, scientific or historical research, or statistical purposes.
You should also periodically review the data you hold, and erase or anonymise it when you no longer need it. “You must carefully consider any challenges to your retention of data.” You can keep personal data for longer if you are only keeping it for public interest archiving, scientific or historical research, or statistical purposes.
Retention policies or retention schedules list the types of record or information you hold, what you use it for, and how long you intend to keep it. They help you establish and document standard retention periods for different categories of personal data. “A retention schedule may form part of a broader ‘information asset register’ (IAR), or your general processing documentation.” To comply with documentation requirements, you need to establish and document standard retention periods for different categories of information you hold wherever possible. It is also advisable to have a system for ensuring that your organisation keeps to these retention periods in practice, and for reviewing retention at appropriate intervals. Your policy must also be flexible enough to allow for early deletion if appropriate. For example, if you are not actually using a record, you should reconsider whether you need to retain it.
Do we need a retention policy? “Retention policies or retention schedules list the types of record or information you hold, what you use it for, and how long you intend to keep it.” A retention schedule may form part of a broader ‘information asset register’ (IAR), or your general processing documentation.