[Company] Data Retention Schedule

• Version: 1.0
• Owner: CTO
• Approved by: CEO
• Effective date: [Effective date]
• Next review date: [Review date]

1. Purpose and Scope

This schedule lists each type of record [Company] holds and gives, for each, how long it is kept and from what event, the basis for that period, the role that owns it, the kind of system it is held in and how it is disposed of when the period ends.

This schedule covers records in every system and format, including copies held by [Company]'s suppliers. It covers both the records [Company] keeps for its own purposes and the data it holds for its customers, which is kept on the customer's instructions and not for [Company]'s own purposes. Where another [Company] document, such as its data management policy or a privacy notice, states a retention period for a record type listed here, that period must match this schedule.

This schedule was prepared from a profile of [Company]'s size, sector, systems, data and obligations, not from an inventory of the records [Company] holds. The record types, periods, owners and systems listed are starting points. Each period is [Company]'s own choice, which it can change. Where the Basis column names a law or a standard, the period must not be shorter than any minimum it sets. At the first review, each record owner confirms or corrects the rows they own, and the CTO raises the version number and updates the dates in the document control list.

2. Roles

• CTO: keeps this schedule, runs its reviews and approves exceptions.
• CEO: approves this schedule, and places and releases legal holds.
• Record owners: each is accountable for the rows they own in section 8, for seeing that those records are deleted when their period ends and for confirming the rows at each review.
• All staff: keep records in the systems that section 8 names and tell the CTO about a type of record that no row covers.

3. How Retention Periods Are Set

• Each row in section 7 gives the record type; its classification, which is one of the four levels [Company] uses to classify data, Restricted, Confidential, Internal and Public; how long it is kept; the event the period starts from; and the basis for the period. Section 8 gives each row's owner, the kind of system it is held in and how it is disposed of.
• A period runs from the event in the Starts from column, and a record is kept until the period has passed.
• "Business need" means [Company] chose the period as the time it needs the record for the work the record supports and to answer questions about that work afterwards.
• "Contract" means the customer's contract sets how long [Company] keeps the data, and the period shown applies unless a customer's contract sets a different one.
• A kind of law followed by "(confirm the minimum)" means that the law of a country where [Company] operates may set a minimum period for records of that kind, that the period shown is [Company]'s own choice, and that the record owner must confirm at the first review, and whenever [Company] starts to operate in another country, that the period is at least any minimum that applies.
• Personal data is kept no longer than the period of the row that covers it, apart from the time section 4 allows for deletion and the holds and exceptions that section 5 allows, and the periods [Company] gives in its privacy notices must match this schedule.
• A record that no row covers takes the period of the row most like it; where no row is like it, the CTO adds a row before the record is deleted.
• A copy of a record in email, chat, a shared folder or on a device takes the period of the record type it belongs to. The copy in the system that section 8 names is the one [Company] keeps; other copies are deleted once they are no longer needed and never kept beyond the period.

4. Deletion and Disposal

• Within 30 days after a record's period ends, the record owner deletes it, or has it deleted, from the system that section 8 names. The bullets below set different rules for the group Data Held for Customers and for the row Backups of production systems.
• [Company] keeps data it holds for customers only while the customer's contract runs. When the contract ends, [Company] returns the data to the customer where the contract or the customer asks for that, and deletes it from the systems that section 8 names for those rows no later than 30 days after the end of the contract, which is the period section 7 gives; the further 30 days in the first bullet do not apply. The same applies to data derived from customer data. [Company] never keeps data it holds for customers beyond that period for its own purposes. Where a customer's contract sets a different period or a different way of returning or destroying the data, the contract applies. [Company]'s own records about the customer, such as account, contract and support records, are not data held for the customer and follow their own rows in section 7.
• Backups are not edited to remove single records. Each backup must be overwritten 30 days after it is taken, so a record deleted from the production systems can remain in backups for up to 30 days more, and is deleted again if a backup that still holds it is restored. No copy of the data held for a customer therefore remains in the systems that section 8 names or in their backups more than 60 days after the contract ends.
• The Disposal column uses these values and no others: "Delete", which means removing the record through the system's own deletion function or an automatic expiry setting; "Return or delete", used only for data held for customers; and "Overwrite on the backup cycle", used only for backups.
• Where a record is held in a supplier's system, deletion relies on the supplier's own process, set out in its contract.
• Each deletion is recorded with the row's ID, the date, the system and the role that carried it out; where a system deletes records automatically, the setting that does so is the record. These records are kept for the period the row Deletion and disposal records sets (DR-17).
• Devices and removable media that held records are wiped or destroyed before they are reused, returned or thrown away.

5. Legal Holds and Exceptions

• A legal hold stops the deletion of records that are relevant to a claim, an investigation, an audit or a request from a regulator. The CEO places a hold in writing, naming the record types it covers, and the record owners stop deleting those records, including any automatic deletion, until the CEO releases the hold in writing. A hold overrides every period in this schedule.
• When a hold is released, records whose period has passed are deleted within 30 days.
• Keeping any other record beyond its period needs the written approval of the CTO, with the reason and a new end date no more than 12 months after the period ended; the CTO keeps a list of these exceptions and reviews it at each review of this schedule.
• No exception is given for data held for customers unless the customer asks for it in writing.
• A person's request to have their data deleted is handled under [Company]'s process for such requests; where that process finds the data must be deleted, it is deleted before its period ends. Where the record is under a legal hold, or a law requires [Company] to keep it, [Company] keeps it for that purpose only, until the hold is released or the period that law requires has passed. A request about data [Company] holds for a customer is passed to that customer.

6. Review and Maintenance

• The CTO reviews the whole schedule with the record owners at least once every 12 months, and the CEO approves it at least once every 12 months.
• Each review checks that every row still matches the records [Company] holds, that every minimum marked "(confirm the minimum)" has been confirmed, and, for a sample of rows, that records past their period were deleted and the deletion was recorded.
• A row is reviewed sooner when [Company] starts to hold a new type of record, adopts a new system, starts to operate in another country, agrees a customer contract with a different retention term, or after an audit finding about retention.
• A new row takes the next unused ID, and IDs are never reused.
• A change to a period is carried into [Company]'s privacy notices and any other document that states it within 1 month.
• Previous versions of this schedule are kept for the period the row Policies, procedures and risk assessments sets (DR-15).

7. Retention Schedule

Each row below is a type of record, with how long [Company] keeps it, the event the period starts from and the basis for the period.

7.1 Data Held for Customers

7.2 Customer and Contact Records

7.3 People Records

7.4 Finance and Legal Records

7.5 Systems and Security Records

8. Owners, Locations and Disposal

Each row below gives the role that owns the record type, the kind of system it is held in and how it is disposed of when its period ends.

Disclaimer

This document is provided for informational purposes only and does not constitute legal advice. It is provided "as is", without warranty of any kind, express or implied, and no liability is accepted for any loss or damage arising from its use. It is used at your own discretion. Review it with a qualified adviser before adopting it.

[Company] Data Retention Schedule

• Version: 1.0
• Owner: Head of security
• Approved by: CEO
• Effective date: [Effective date]
• Next review date: [Review date]

1. Purpose and Scope

This schedule lists each type of record [Company] holds and gives, for each, how long it is kept and from what event, the basis for that period, the role that owns it, the kind of system it is held in and how it is disposed of when the period ends.

This schedule covers records in every system and format, including copies held by [Company]'s suppliers. It covers both the records [Company] keeps for its own purposes and the data it holds for its customers, which is kept on the customer's instructions and not for [Company]'s own purposes. Where another of [Company]'s documents, such as its data management policy or a privacy notice, states a retention period for a record type listed here, that period must match this schedule.

This schedule was prepared from a profile of [Company]'s size, sector, systems, data and obligations, not from an inventory of the records [Company] holds. The record types, periods, owners and systems listed are starting points. Each period is [Company]'s own choice, which it can change. Where the Basis column names a law or a standard, the period must not be shorter than any minimum it sets. At the first review, each record owner confirms or corrects the rows they own, and the head of security raises the version number and updates the dates in the document control list.

2. Roles

• The head of security keeps this schedule, runs its reviews and approves exceptions.
• The CEO approves this schedule, and places and releases legal holds.
• The record owners are the head of engineering, the head of operations, the head of finance, the CEO and the head of security. Each is accountable for the rows they own in section 8, for seeing that those records are deleted when their period ends and for confirming the rows at each review.
• All staff keep records in the systems that section 8 names and tell the head of security about a type of record that no row covers.

3. How Retention Periods Are Set

• Each row in section 7 gives the record type; its classification, which is one of the four levels [Company] uses to classify data, Restricted, Confidential, Internal and Public; how long it is kept; the event the period starts from; and the basis for the period. Section 8 gives each row's owner, the kind of system it is held in and how it is disposed of.
• A period runs from the event in the Starts from column, and a record is kept until the period has passed.
• "Business need" means [Company] chose the period as the time it needs the record for the work the record supports and to answer questions about that work afterwards.
• "Contract" means the customer's contract sets how long [Company] keeps the data, and the period shown applies unless a customer's contract sets a different one.
• A kind of law followed by "(confirm the minimum)" means that the law of a country where [Company] operates may set a minimum period for records of that kind, that the period shown is [Company]'s own choice, and that the record owner must confirm at the first review, and whenever [Company] starts to operate in another country, that the period is at least any minimum that applies.
• Personal data is kept no longer than the period of the row that covers it, apart from the time section 4 allows for deletion and the holds and exceptions that section 5 allows, and the periods [Company] gives in its privacy notices must match this schedule.
• A record that no row covers takes the period of the row most like it; where no row is like it, the head of security adds a row before the record is deleted.
• A copy of a record in email, chat, a shared folder or on a device takes the period of the record type it belongs to. The copy in the system that section 8 names is the one [Company] keeps; other copies are deleted once they are no longer needed and never kept beyond the period.

4. Deletion and Disposal

• Within 30 days after a record's period ends, the record owner deletes it, or has it deleted, from the system that section 8 names. The bullets below set different rules for the group Data Held for Customers and the row Backups of production systems.
• [Company] keeps data it holds for customers only while the customer's contract runs. When the contract ends, [Company] returns the data to the customer where the contract or the customer asks for that, and deletes it from the systems that section 8 names for those rows no later than 30 days after the end of the contract, which is the period section 7 gives; the further 30 days in the first bullet do not apply. The same applies to data derived from customer data, such as AI inputs and outputs. [Company] never keeps data it holds for customers beyond that period for its own purposes. Where a customer's contract sets a different period or a different way of returning or destroying the data, the contract applies. [Company]'s own records about the customer, such as account, contract and support records, are not data held for the customer and follow their own rows in section 7.
• Backups are not edited to remove single records. Each backup must be overwritten 30 days after it is taken, so a record deleted from the production systems can remain in backups for up to 30 days more, and is deleted again if a backup that still holds it is restored. No copy of the data held for a customer therefore remains in the systems that section 8 names or in their backups more than 60 days after the contract ends.
• The Disposal column uses these values and no others: "Delete", which means removing the record through the system's own deletion function or an automatic expiry setting; "Return or delete", used only for data held for customers; and "Overwrite on the backup cycle", used only for backups.
• Where a record is held in a supplier's system, deletion relies on the supplier's own process, set out in its contract.
• Each deletion is recorded with the row's ID, the date, the system and the role that carried it out; where a system deletes records automatically, the setting that does so is the record. These records are kept for the period the row Deletion and disposal records sets (DR-19).
• Devices and removable media that held records are wiped or destroyed before they are reused, returned or thrown away.
• Paper copies of a record are shredded when its period ends.

5. Legal Holds and Exceptions

• A legal hold stops the deletion of records that are relevant to a claim, an investigation, an audit or a request from a regulator. The CEO places a hold in writing, naming the record types it covers, and the record owners stop deleting those records, including any automatic deletion, until the CEO releases the hold in writing. A hold overrides every period in this schedule.
• When a hold is released, records whose period has passed are deleted within 30 days.
• Keeping any other record beyond its period needs the written approval of the head of security, with the reason and a new end date no more than 12 months after the period ended; the head of security keeps a list of these exceptions and reviews it at each review of this schedule.
• No exception is given for data held for customers unless the customer asks for it in writing.
• A person's request to have their data deleted is handled under [Company]'s process for such requests; where that process finds the data must be deleted, it is deleted before its period ends. Where the record is under a legal hold, or a law requires [Company] to keep it, [Company] keeps it for that purpose only, until the hold is released or the period that law requires has passed. A request about data [Company] holds for a customer is passed to that customer.

6. Review and Maintenance

• The head of security reviews the whole schedule with the record owners at least once every 12 months, and the CEO approves it at least once every 12 months.
• Each review checks that every row still matches the records [Company] holds, that every minimum marked "(confirm the minimum)" has been confirmed, and, for a sample of rows, that records past their period were deleted and the deletion was recorded.
• A row is reviewed sooner when [Company] starts to hold a new type of record, adopts a new system, starts to operate in another country, agrees a customer contract with a different retention term, or after an audit finding about retention.
• A new row takes the next unused ID, and IDs are never reused.
• A change to a period is carried into [Company]'s privacy notices and any other document that states it within 1 month.
• Previous versions of this schedule are kept for the period the row Policies, procedures and risk assessments sets (DR-17).

7. Retention Schedule

Each row below is a record type, with its classification, how long it is kept, the event the period starts from and the basis for that period.

7.1 Data Held for Customers

7.2 Customer and Contact Records

7.3 People Records

7.4 Finance and Legal Records

7.5 Systems and Security Records

8. Owners, Locations and Disposal

Each row below gives the owner, the kind of system and the disposal for the record type with the same ID in section 7.

Disclaimer

This document is provided for informational purposes only and does not constitute legal advice. It is provided "as is", without warranty of any kind, express or implied, and no liability is accepted for any loss or damage arising from its use. It is used at your own discretion. Review it with a qualified adviser before adopting it.

[Company] Data Retention Schedule

• Version: 1.0
• Owner: Head of security
• Approved by: CEO
• Effective date: [Effective date]
• Next review date: [Review date]

1. Purpose and Scope

This schedule lists each type of record [Company] holds and gives, for each, how long it is kept and from what event, the basis for that period, the role that owns it, the kind of system it is held in and how it is disposed of when the period ends.

This schedule covers records in every system and format, including copies held by [Company]'s suppliers. It covers both the records [Company] keeps for its own purposes and the data it holds for its customers, which is kept on the customer's instructions and not for [Company]'s own purposes. Where another of [Company]'s documents, such as its data management policy or a privacy notice, states a retention period for a record type listed here, that period must match this schedule.

This schedule was prepared from a profile of [Company]'s size, sector, systems, data and obligations, not from an inventory of the records [Company] holds. The record types, periods, owners and systems listed are starting points. Each period is [Company]'s own choice, which it can change. Where the Basis column names a law or a standard, the period must not be shorter than any minimum it sets. At the first review, each record owner confirms or corrects the rows they own, and the head of security raises the version number and updates the dates in the document control list.

2. Roles

• The head of security keeps this schedule, runs its reviews and approves exceptions.
• The CEO approves this schedule, and places and releases legal holds.
• Record owners, who are the roles named in the Owner column of section 8, are each accountable for the rows they own in section 8, for seeing that those records are deleted when their period ends and for confirming the rows at each review.
• All staff keep records in the systems that section 8 names and tell the head of security about a type of record that no row covers.

3. How Retention Periods Are Set

• Each row in section 7 gives the record type; its classification, which is one of the four levels [Company] uses to classify data, Restricted, Confidential, Internal and Public; how long it is kept; the event the period starts from; and the basis for the period. Section 8 gives each row's owner, the kind of system it is held in and how it is disposed of.
• A period runs from the event in the Starts from column, and a record is kept until the period has passed.
• "Business need" means [Company] chose the period as the time it needs the record for the work the record supports and to answer questions about that work afterwards.
• "Contract" means the customer's contract sets how long [Company] keeps the data, and the period shown applies unless a customer's contract sets a different one.
• A kind of law followed by "(confirm the minimum)" means that the law of a country where [Company] operates may set a minimum period for records of that kind, that the period shown is [Company]'s own choice, and that the record owner must confirm at the first review, and whenever [Company] starts to operate in another country, that the period is at least any minimum that applies.
• Under HIPAA's Security Rule, the documentation the rule requires, such as policies, procedures, risk assessments and records of security incidents and their outcomes, must be kept for 6 years from the date it was created or the date it was last in effect, whichever is later. The rows with the basis HIPAA apply that period.
• Personal data is kept no longer than the period of the row that covers it, apart from the time section 4 allows for deletion and the holds and exceptions that section 5 allows, and the periods [Company] gives in its privacy notices must match this schedule.
• A record that no row covers takes the period of the row most like it; where no row is like it, the head of security adds a row before the record is deleted.
• A copy of a record in email, chat, a shared folder or on a device takes the period of the record type it belongs to. The copy in the system that section 8 names is the one [Company] keeps; other copies are deleted once they are no longer needed and never kept beyond the period.

4. Deletion and Disposal

• Within 30 days after a record's period ends, the record owner deletes it, or has it deleted, from the system that section 8 names. The bullets below set different rules for data held for customers and for the row Backups of production systems.
• [Company] keeps data it holds for customers only while the customer's contract runs. When the contract ends, [Company] returns the data to the customer where the contract or the customer asks for that, and deletes it from the systems that section 8 names for those rows no later than 60 days after the end of the contract, which is the period section 7 gives; the further 30 days in the first bullet do not apply. The same applies to data derived from customer data, such as AI inputs and outputs. [Company] never keeps data it holds for customers beyond that period for its own purposes. Where a customer's contract sets a different period or a different way of returning or destroying the data, the contract applies. [Company]'s own records about the customer, such as account, contract and support records, are not data held for the customer and follow their own rows in section 7. When a business associate agreement ends, protected health information is returned or destroyed in the same way and within the same periods as the rest of the data held for customers, including its copies in backups, where that is feasible; where it is not, [Company] keeps applying the agreement's protections to that information and uses it only for the purposes that make its return or destruction infeasible.
• Backups are not edited to remove single records. Each backup must be overwritten 30 days after it is taken, so a record deleted from the production systems can remain in backups for up to 30 days more, and is deleted again if a backup that still holds it is restored. No copy of the data held for a customer therefore remains in the systems that section 8 names or in their backups more than 90 days after the contract ends.
• The Disposal column uses these values and no others: "Delete", which means removing the record through the system's own deletion function or an automatic expiry setting; "Return or delete", used only for data held for customers; and "Overwrite on the backup cycle", used only for backups.
• Where a record is held in a supplier's system, deletion relies on the supplier's own process, set out in its contract.
• Each deletion is recorded with the row's ID, the date, the system and the role that carried it out; where a system deletes records automatically, the setting that does so is the record. These records are kept for the period the row Deletion and disposal records sets (DR-18).
• Devices and removable media that held records are wiped or destroyed before they are reused, returned or thrown away.
• Paper copies of a record are shredded when its period ends.

5. Legal Holds and Exceptions

• A legal hold stops the deletion of records that are relevant to a claim, an investigation, an audit or a request from a regulator. The CEO places a hold in writing, naming the record types it covers, and the record owners stop deleting those records, including any automatic deletion, until the CEO releases the hold in writing. A hold overrides every period in this schedule.
• When a hold is released, records whose period has passed are deleted within 30 days.
• Keeping any other record beyond its period needs the written approval of the head of security, with the reason and a new end date no more than 12 months after the period ended; the head of security keeps a list of these exceptions and reviews it at each review of this schedule.
• No exception is given for data held for customers unless the customer asks for it in writing.

6. Review and Maintenance

• The head of security reviews the whole schedule with the record owners at least once every 12 months, and the CEO approves it at least once every 12 months.
• Each review checks that every row still matches the records [Company] holds, that every minimum marked "(confirm the minimum)" has been confirmed, and, for a sample of rows, that records past their period were deleted and the deletion was recorded.
• A row is reviewed sooner when [Company] starts to hold a new type of record, adopts a new system, starts to operate in another country, agrees a customer contract with a different retention term, or after an audit finding about retention.
• A new row takes the next unused ID, and IDs are never reused.
• A change to a period is carried into [Company]'s privacy notices and any other document that states it within 1 month.
• Previous versions of this schedule are kept for the period the row Policies, procedures and risk assessments sets (DR-17).

7. Retention Schedule

Each row below gives one type of record, how long it is kept, the event the period starts from and the basis for the period.

7.1 Data Held for Customers

7.2 Customer and Contact Records

7.3 People Records

7.4 Finance and Legal Records

7.5 Systems and Security Records

8. Owners, Locations and Disposal

Each row below gives the role that owns the record type, the kind of system it is held in and how it is disposed of.

Disclaimer

This document is provided for informational purposes only and does not constitute legal advice. It is provided "as is", without warranty of any kind, express or implied, and no liability is accepted for any loss or damage arising from its use. It is used at your own discretion. Review it with a qualified adviser before adopting it.

[Company] Data Retention Schedule

• Version: 1.0
• Owner: CISO
• Approved by: CEO
• Effective date: [Effective date]
• Next review date: [Review date]

1. Purpose and Scope

This schedule lists each type of record [Company] holds and gives, for each, how long it is kept and from what event, the basis for that period, the role that owns it, the kind of system it is held in and how it is disposed of when the period ends.

This schedule covers records in every system and format, including copies held by [Company]'s suppliers. It covers both the records [Company] keeps for its own purposes and the data it holds for its customers, which is kept on the customer's instructions and not for [Company]'s own purposes. Where another of [Company]'s documents, such as its data management policy or a privacy notice, states a retention period for a record type listed here, that period must match this schedule.

This schedule was prepared from a profile of [Company]'s size, sector, systems, data and obligations, not from an inventory of the records [Company] holds. The record types, periods, owners and systems listed are starting points. Each period is [Company]'s own choice, which it can change. Where the Basis column names a law or a standard, the period must not be shorter than any minimum it sets. At the first review, each record owner confirms or corrects the rows they own, and the CISO raises the version number and updates the dates in the document control list.

2. Roles

• CISO: keeps this schedule, runs its reviews and approves exceptions.
• CEO: approves this schedule, and places and releases legal holds.
• Record owners: each is accountable for the rows they own in section 8, for seeing that those records are deleted when their period ends and for confirming the rows at each review.
• All staff: keep records in the systems that section 8 names and tell the CISO about a type of record that no row covers.

3. How Retention Periods Are Set

• Each row in section 7 gives the record type; its classification, which is one of the four levels [Company] uses to classify data, Restricted, Confidential, Internal and Public; how long it is kept; the event the period starts from; and the basis for the period. Section 8 gives each row's owner, the kind of system it is held in and how it is disposed of.
• A period runs from the event in the Starts from column, and a record is kept until the period has passed.
• "Business need" means [Company] chose the period as the time it needs the record for the work the record supports and to answer questions about that work afterwards.
• "Contract" means the customer's contract sets how long [Company] keeps the data, and the period shown applies unless a customer's contract sets a different one.
• A kind of law followed by "(confirm the minimum)" means that the law of a country where [Company] operates may set a minimum period for records of that kind, that the period shown is [Company]'s own choice, and that the record owner must confirm at the first review, and whenever [Company] starts to operate in another country, that the period is at least any minimum that applies.
• Personal data is kept no longer than the period of the row that covers it, apart from the time section 4 allows for deletion and the holds and exceptions that section 5 allows, and the periods [Company] gives in its privacy notices must match this schedule.
• A record that no row covers takes the period of the row most like it; where no row is like it, the CISO adds a row before the record is deleted.
• A copy of a record in email, chat, a shared folder or on a device takes the period of the record type it belongs to. The copy in the system that section 8 names is the one [Company] keeps; other copies are deleted once they are no longer needed and never kept beyond the period.

4. Deletion and Disposal

• Within 30 days after a record's period ends, the record owner deletes it, or has it deleted, from the system that section 8 names. The bullets below set different rules for the rows in the group Data Held for Customers and for the row Backups of production systems.
• [Company] keeps data it holds for customers only while the customer's contract runs. When the contract ends, [Company] returns the data to the customer where the contract or the customer asks for that, and deletes it from the systems that section 8 names for those rows no later than 90 days after the end of the contract, which is the period section 7 gives; the further 30 days in the first bullet do not apply. The same applies to data derived from customer data. [Company] never keeps data it holds for customers beyond that period for its own purposes. Where a customer's contract sets a different period or a different way of returning or destroying the data, the contract applies. [Company]'s own records about the customer, such as account, contract and support records, are not data held for the customer and follow their own rows in section 7.
• Backups are not edited to remove single records. Each backup must be overwritten 30 days after it is taken, so a record deleted from the production systems can remain in backups for up to 30 days more, and is deleted again if a backup that still holds it is restored. No copy of the data held for a customer therefore remains in the systems that section 8 names or in their backups more than 120 days after the contract ends.
• The Disposal column uses these values and no others: "Delete", which means removing the record through the system's own deletion function or an automatic expiry setting; "Return or delete", used only for data held for customers; and "Overwrite on the backup cycle", used only for backups.
• Where a record is held in a supplier's system, deletion relies on the supplier's own process, set out in its contract.
• Each deletion is recorded with the row's ID, the date, the system and the role that carried it out; where a system deletes records automatically, the setting that does so is the record. These records are kept for the period the row Deletion and disposal records sets (DR-18).
• Devices and removable media that held records are wiped or destroyed before they are reused, returned or thrown away.
• Paper copies of a record are shredded when its period ends.

5. Legal Holds and Exceptions

• A legal hold stops the deletion of records that are relevant to a claim, an investigation, an audit or a request from a regulator. The CEO places a hold in writing, naming the record types it covers, and the record owners stop deleting those records, including any automatic deletion, until the CEO releases the hold in writing. A hold overrides every period in this schedule.
• When a hold is released, records whose period has passed are deleted within 30 days.
• Keeping any other record beyond its period needs the written approval of the CISO, with the reason and a new end date no more than 12 months after the period ended; the CISO keeps a list of these exceptions and reviews it at each review of this schedule.
• No exception is given for data held for customers unless the customer asks for it in writing.

6. Review and Maintenance

• The CISO reviews the whole schedule with the record owners at least once every 12 months, and the CEO approves it at least once every 12 months.
• Each review checks that every row still matches the records [Company] holds, that every minimum marked "(confirm the minimum)" has been confirmed, and, for a sample of rows, that records past their period were deleted and the deletion was recorded.
• A row is reviewed sooner when [Company] starts to hold a new type of record, adopts a new system, starts to operate in another country or agrees a customer contract with a different retention term, or after an audit finding about retention.
• A new row takes the next unused ID, and IDs are never reused.
• A change to a period is carried into [Company]'s privacy notices and any other document that states it within 1 month.
• Previous versions of this schedule are kept for the period the row Policies, procedures and risk assessments sets (DR-17).

7. Retention Schedule

The tables below list each record type [Company] holds, grouped by the kind of record.

7.1 Data Held for Customers

7.2 Customer and Contact Records

7.3 People Records

7.4 Finance and Legal Records

7.5 Systems and Security Records

8. Owners, Locations and Disposal

The table below gives the owner, the kind of system the record is held in and the disposal for each row in section 7.

Disclaimer

This document is provided for informational purposes only and does not constitute legal advice. It is provided "as is", without warranty of any kind, express or implied, and no liability is accepted for any loss or damage arising from its use. It is used at your own discretion. Review it with a qualified adviser before adopting it.

[Company] Data Retention Schedule

• Version: 1.0
• Owner: CISO
• Approved by: Board
• Effective date: [Effective date]
• Next review date: [Review date]

1. Purpose and Scope

This schedule lists each type of record [Company] holds and gives, for each, how long it is kept and from what event, the basis for that period, the role that owns it, the kind of system it is held in and how it is disposed of when the period ends.

This schedule covers records in every system and format, including copies held by [Company]'s suppliers. It covers both the records [Company] keeps for its own purposes and the data it holds for its customers, which is kept on the customer's instructions and not for [Company]'s own purposes. Where another of [Company]'s documents, such as its data management policy or a privacy notice, states a retention period for a record type listed here, that period must match this schedule.

This schedule was prepared from a profile of [Company]'s size, sector, systems, data and obligations, not from an inventory of the records [Company] holds. The record types, periods, owners and systems listed are starting points. Each period is [Company]'s own choice, which it can change. Where the Basis column names a law or a standard, the period must not be shorter than any minimum it sets. At the first review, each record owner confirms or corrects the rows they own, and the CISO raises the version number and updates the dates in the document control list.

2. Roles

• The CISO keeps this schedule, runs its reviews and approves exceptions.
• The board approves this schedule.
• The record owners, who are the roles named in the Owner column of section 8, are each accountable for the rows they own in section 8, for seeing that those records are deleted when their period ends and for confirming the rows at each review.
• The head of legal places and releases legal holds, as section 5 sets out.
• All staff keep records in the systems that section 8 names and tell the CISO about a type of record that no row covers.

3. How Retention Periods Are Set

• Each row in section 7 gives the record type; its classification, which is one of the four levels [Company] uses to classify data, Restricted, Confidential, Internal and Public; how long it is kept; the event the period starts from; and the basis for the period. Section 8 gives each row's owner, the kind of system it is held in and how it is disposed of.
• A period runs from the event in the Starts from column, and a record is kept until the period has passed.
• "Business need" means [Company] chose the period as the time it needs the record for the work the record supports and to answer questions about that work afterwards.
• "Contract" means the customer's contract sets how long [Company] keeps the data, and the period shown applies unless a customer's contract sets a different one.
• A kind of law followed by "(confirm the minimum)" means that the law of a country where [Company] operates may set a minimum period for records of that kind, that the period shown is [Company]'s own choice, and that the record owner must confirm at the first review, and whenever [Company] starts to operate in another country, that the period is at least any minimum that applies.
• Personal data is kept no longer than the period of the row that covers it, apart from the time section 4 allows for deletion and the holds and exceptions that section 5 allows, and the periods [Company] gives in its privacy notices must match this schedule.
• A record that no row covers takes the period of the row most like it; where no row is like it, the CISO adds a row before the record is deleted.
• A copy of a record in email, chat, a shared folder or on a device takes the period of the record type it belongs to. The copy in the system that section 8 names is the one [Company] keeps; other copies are deleted once they are no longer needed and never kept beyond the period.

4. Deletion and Disposal

• Within 30 days after a record's period ends, the record owner deletes it, or has it deleted, from the system that section 8 names. The bullets below set different rules for the rows in Data Held for Customers and for the row Backups of production systems.
• [Company] keeps data it holds for customers only while the customer's contract runs. When the contract ends, [Company] returns the data to the customer where the contract or the customer asks for that, and deletes it from the systems that section 8 names for those rows no later than 90 days after the end of the contract, which is the period section 7 gives; the further 30 days in the first bullet do not apply. The same applies to data derived from customer data, such as AI inputs and outputs. [Company] never keeps data it holds for customers beyond that period for its own purposes. Where a customer's contract sets a different period or a different way of returning or destroying the data, the contract applies. [Company]'s own records about the customer, such as account, contract and support records, are not data held for the customer and follow their own rows in section 7.
• Backups are not edited to remove single records. Each backup must be overwritten 30 days after it is taken, so a record deleted from the production systems can remain in backups for up to 30 days more, and is deleted again if a backup that still holds it is restored. No copy of the data held for a customer therefore remains in the systems that section 8 names or in their backups more than 120 days after the contract ends.
• The Disposal column uses these values and no others. "Delete" means removing the record through the system's own deletion function or an automatic expiry setting. "Return or delete" is used only for data held for customers. "Overwrite on the backup cycle" is used only for backups.
• Where a record is held in a supplier's system, deletion relies on the supplier's own process, set out in its contract.
• Each deletion is recorded with the row's ID, the date, the system and the role that carried it out; where a system deletes records automatically, the setting that does so is the record. These records are kept for the period the row Deletion and disposal records sets (DR-20).
• Devices and removable media that held records are wiped or destroyed before they are reused, returned or thrown away.
• Paper copies of a record are shredded when its period ends.

5. Legal Holds and Exceptions

• A legal hold stops the deletion of records that are relevant to a claim, an investigation, an audit or a request from a regulator. The head of legal places a hold in writing, naming the record types it covers, and the record owners stop deleting those records, including any automatic deletion, until the head of legal releases the hold in writing. A hold overrides every period in this schedule.
• When a hold is released, records whose period has passed are deleted within 30 days.
• Keeping any other record beyond its period needs the written approval of the CISO, with the reason and a new end date no more than 12 months after the period ended; the CISO keeps a list of these exceptions and reviews it at each review of this schedule.
• No exception is given for data held for customers unless the customer asks for it in writing.
• A person's request to have their data deleted is handled under [Company]'s process for such requests; where that process finds the data must be deleted, it is deleted before its period ends. Where the record is under a legal hold, or a law requires [Company] to keep it, [Company] keeps it for that purpose only, until the hold is released or the period that law requires has passed. A request about data [Company] holds for a customer is passed to that customer.

6. Review and Maintenance

• The CISO reviews the whole schedule with the record owners at least once every 12 months, and the board approves it at least once every 12 months.
• Each review checks that every row still matches the records [Company] holds, that every minimum marked "(confirm the minimum)" has been confirmed, and, for a sample of rows, that records past their period were deleted and the deletion was recorded.
• A row is reviewed sooner when [Company] starts to hold a new type of record, adopts a new system, starts to operate in another country, agrees a customer contract with a different retention term, or after an audit finding about retention.
• A new row takes the next unused ID, and IDs are never reused.
• A change to a period is carried into [Company]'s privacy notices and any other document that states it within 1 month.
• Previous versions of this schedule are kept for the period the row Policies, procedures and risk assessments sets (DR-18).

7. Retention Schedule

This section lists each type of record [Company] holds, how long it is kept, the event the period starts from and the basis for the period.

7.1 Data Held for Customers

7.2 Customer and Contact Records

7.3 People Records

7.4 Finance and Legal Records

7.5 Systems and Security Records

8. Owners, Locations and Disposal

This section gives, for each row in section 7, the role that owns it, the kind of system it is held in and how it is disposed of.

Disclaimer

This document is provided for informational purposes only and does not constitute legal advice. It is provided "as is", without warranty of any kind, express or implied, and no liability is accepted for any loss or damage arising from its use. It is used at your own discretion. Review it with a qualified adviser before adopting it.

[Company] Data Retention Schedule

• Version: 1.0
• Owner: Executive director
• Approved by: Board
• Effective date: [Effective date]
• Next review date: [Review date]

1. Purpose and Scope

This schedule lists each type of record [Company] holds and gives, for each, how long it is kept and from what event, the basis for that period, the role that owns it, the kind of system it is held in and how it is disposed of when the period ends.

This schedule covers records in every system and format, including copies held by [Company]'s suppliers. Where another of [Company]'s documents, such as its data management policy or a privacy notice, states a retention period for a record type listed here, that period must match this schedule.

This schedule was prepared from a profile of [Company]'s size, sector, systems, data and obligations, not from an inventory of the records [Company] holds. The record types, periods, owners and systems listed are starting points. Each period is [Company]'s own choice, which it can change. Where the Basis column names a law or a standard, the period must not be shorter than any minimum it sets. At the first review, each record owner confirms or corrects the rows they own, and the executive director raises the version number and updates the dates in the document control list.

2. Roles

• The executive director keeps this schedule, runs its reviews and approves exceptions. The executive director also places and releases legal holds.
• The board approves this schedule.
• Record owners are each accountable for the rows they own in section 8, for seeing that those records are deleted when their period ends and for confirming the rows at each review.
• All staff and volunteers keep records in the systems that section 8 names and tell the executive director about a type of record that no row covers.

3. How Retention Periods Are Set

• Each row in section 7 gives the record type; its classification, which is one of the four levels [Company] uses to classify data, Restricted, Confidential, Internal and Public; how long it is kept; the event the period starts from; and the basis for the period. Section 8 gives each row's owner, the kind of system it is held in and how it is disposed of.
• A period runs from the event in the Starts from column, and a record is kept until the period has passed.
• "Business need" means [Company] chose the period as the time it needs the record for the work the record supports and to answer questions about that work afterwards.
• A kind of law followed by "(confirm the minimum)" means that the law of a country where [Company] operates may set a minimum period for records of that kind, that the period shown is [Company]'s own choice, and that the record owner must confirm at the first review, and whenever [Company] starts to operate in another country, that the period is at least any minimum that applies.
• Sensitive authentication data, such as the card security code, must not be stored after a payment is authorized, even if it is encrypted, so no row gives it a period.
• Personal data is kept no longer than the period of the row that covers it, apart from the time section 4 allows for deletion and the holds and exceptions that section 5 allows, and the periods [Company] gives in its privacy notices must match this schedule.
• A record that no row covers takes the period of the row most like it; where no row is like it, the executive director adds a row before the record is deleted.
• A copy of a record in email, chat, a shared folder or on a device takes the period of the record type it belongs to. The copy in the system that section 8 names is the one [Company] keeps; other copies are deleted once they are no longer needed and never kept beyond the period.

4. Deletion and Disposal

• Within 30 days after a record's period ends, the record owner deletes it, or has it deleted, from the system that section 8 names.
• Copies of deleted records in a supplier's backups are removed on the supplier's own cycle, as its contract sets out.
• The Disposal column uses the value "Delete", which means removing the record through the system's own deletion function or an automatic expiry setting.
• Where a record is held in a supplier's system, deletion relies on the supplier's own process, set out in its contract.
• Each deletion is recorded with the row's ID, the date, the system and the role that carried it out; where a system deletes records automatically, the setting that does so is the record. These records are kept for the period the row Deletion and disposal records sets (DR-15).
• Devices and removable media that held records are wiped or destroyed before they are reused, returned or thrown away.
• Paper copies of a record are shredded when its period ends.

5. Legal Holds and Exceptions

• A legal hold stops the deletion of records that are relevant to a claim, an investigation, an audit or a request from a regulator. The executive director places a hold in writing, naming the record types it covers, and the record owners stop deleting those records, including any automatic deletion, until the executive director releases the hold in writing. A hold overrides every period in this schedule.
• When a hold is released, records whose period has passed are deleted within 30 days.
• Keeping any other record beyond its period needs the written approval of the executive director, with the reason and a new end date no more than 12 months after the period ended; the executive director keeps a list of these exceptions and reviews it at each review of this schedule.
• A person's request to have their data deleted is handled under [Company]'s process for such requests; where that process finds the data must be deleted, it is deleted before its period ends. Where the record is under a legal hold, or a law requires [Company] to keep it, [Company] keeps it for that purpose only, until the hold is released or the period that law requires has passed.

6. Review and Maintenance

• The executive director reviews the whole schedule with the record owners at least once every 12 months, and the board approves it at least once every 12 months.
• Each review checks that every row still matches the records [Company] holds, that every minimum marked "(confirm the minimum)" has been confirmed, and, for a sample of rows, that records past their period were deleted and the deletion was recorded.
• A row is reviewed sooner when [Company] starts to hold a new type of record, adopts a new system or starts to operate in another country, or after an audit finding about retention.
• A new row takes the next unused ID, and IDs are never reused.
• A change to a period is carried into [Company]'s privacy notices and any other document that states it within 1 month.
• Previous versions of this schedule are kept for the period the row Policies, procedures and risk assessments sets (DR-13).

7. Retention Schedule

This section lists each record type [Company] holds, how long it is kept, and the event the period starts from.

7.1 Donor, Beneficiary and Contact Records

7.2 People Records

7.3 Finance and Legal Records

7.4 Systems and Security Records

8. Owners, Locations and Disposal

This section gives the owner, the kind of system that holds the record and the disposal for each row in section 7.

Disclaimer

This document is provided for informational purposes only and does not constitute legal advice. It is provided "as is", without warranty of any kind, express or implied, and no liability is accepted for any loss or damage arising from its use. It is used at your own discretion. Review it with a qualified adviser before adopting it.