Last updated: 17 October 2026
---ARTICLE---
Data retention policy template UK: what to include and how long to keep records
A data retention policy template UK organisations can rely on sets out, in writing, which categories of personal data are held, the lawful reason for holding each one, the retention period, and the trigger for secure deletion. Without one, the Information Commissioner's Office (ICO) treats indefinite or undocumented retention as a breach of UK GDPR's storage limitation principle — a finding it has made public before.
Key Takeaways
- Pulse Operations notes that a data retention policy template UK businesses use must map every personal data category to a lawful basis, a named retention period, and a deletion trigger.
- UK GDPR fines can reach up to £17.5 million or 4% of global annual turnover for serious infringements, per Sprintlaw UK (2026).
- The ICO issued 14 monetary penalties totalling £21.7 million in 2026, averaging £1.6 million each, up from 17 penalties totalling £2.5 million in 2026, according to Miller & Partner (2026).
- HMRC's default standard retention period for business records is 6 years plus the current year, per GOV.UK (2026).
- PECR marketing fines rose to the same £17.5 million ceiling as UK GDPR on 5 February 2026 under the Data (Use and Access) Act 2026, per Miller & Partner (2026).
What is a data retention policy and why does a UK business need one?
A data retention policy is a written document that defines how long an organisation keeps each category of personal data and what happens to it once that period ends. It exists because UK GDPR's storage limitation principle, set out under Article 5(1)(e), prohibits keeping personal data "for longer than is necessary for the purposes for which it is processed."
The ICO's own guidance on storage limitation is explicit: an organisation must be able to justify how long it keeps data, and it needs a policy — or at minimum a retention schedule — to demonstrate that justification during an audit or investigation. The ICO has made enforcement findings against organisations with no retention policy at all, citing specifically that the absence of one means the firm "cannot ensure that personal data is not held for longer than necessary."
For a UK business, the policy is not optional paperwork. It's the evidence trail that shows a regulator, a litigant, or an insurer that data isn't being hoarded, and it's the first document most ICO investigations ask to see. Sector bodies — the Security Industry Authority (SIA), the Health and Safety Executive (HSE), Companies House — all expect the underlying records to exist for set periods, but UK GDPR separately demands that personal data within those records isn't kept beyond its justified use.
What UK laws and regulations govern data retention?
UK GDPR and the Data Protection Act 2018 are the two primary instruments governing how long personal data may be retained in the UK. UK GDPR sits alongside the Data Protection Act 2018, which translates the regulation into domestic law and adds UK-specific provisions, including ICO enforcement powers.
Several other statutes layer on top, because retention is rarely governed by data protection law alone:
- The Limitation Act 1980 — sets the time limits within which legal claims can be brought, which indirectly dictates how long contractual and liability-related records should be kept (commonly six years for simple contracts).
- The Companies Act 2006 — requires accounting records to be retained for a minimum period after the end of the financial year they relate to.
- The Employment Rights Act 1996 — underpins statutory retention expectations for HR and payroll records.
- The Data (Use and Access) Act 2026 — recently reformed enforcement, including raising PECR marketing fines from a £500,000 cap to the same £17.5 million (or 4% of turnover) ceiling as UK GDPR, effective 5 February 2026, per Miller & Partner (2026).
The ICO regulates compliance across all of this and publishes its own model retention and disposal policy as a working example — a useful cross-check for any template a business builds internally.
What should be included in a data retention policy template?
A data retention policy template needs five core components to be defensible: a data inventory, a lawful basis for each category, a named retention period, a review and deletion process, and ownership. Missing any one of these turns the document into a policy statement with no operational teeth.
The core template structure
| Section | What it must contain |
|---|---|
| Data inventory | Every category of personal data processed (HR, payroll, customer, CCTV, marketing, applicant data) |
| Lawful basis | The Article 6 basis relied on for each category (contract, legal obligation, legitimate interest, consent) |
| Retention period | A specific duration or trigger event, tied to a named law where one applies |
| Review trigger | The date or event that prompts review — contract end, employment termination, last transaction |
| Disposal method | Secure deletion or destruction method and who executes it |
| Owner | The named role accountable for that category's compliance |
| Exceptions | Legal holds — data kept beyond the normal period because of litigation, an FOI request, or an ongoing investigation |
A policy that only states "we keep data as long as necessary" without a schedule attached won't satisfy an ICO audit. The ICO's Data Protection Audit Framework explicitly expects organisations to document retention schedules and disposal actions, not just a policy paragraph.
How long should different types of personal data be retained under UK GDPR?
UK GDPR doesn't set fixed retention periods itself — it requires organisations to justify whatever period they choose against the purpose for processing. Statutory minimums from other legislation then fill in specific numbers for specific record types.
Statutory and recommended retention periods
| Record type | Typical retention period | Legal basis |
|---|---|---|
| General business records (HMRC) | 6 years + current year | GOV.UK — HMRC Records Management Policy (2026) |
| PAYE records | Minimum 3 years after the tax year ends | The Income Tax (PAYE) Regulations 2003 (2015) |
| Accounting records (Companies Act) | Minimum 6 years from financial year end | Companies Act 2006 |
| Employee HR files (post-employment) | Typically 6 years from termination | Limitation Act 1980 (illustrative — aligns with contractual claim limits) |
| CCTV footage | Typically 30 days unless flagged as evidence | ICO guidance and proportionality principle (illustrative) |
| Recruitment/applicant data (unsuccessful) | Typically 6-12 months | ICO guidance on proportionality (illustrative) |
| Marketing consent records | Until consent withdrawn, plus evidence retained after | PECR and UK GDPR consent requirements |
Note the distinction: HMRC and PAYE periods are statutory minimums backed by legislation. HR, CCTV and recruitment figures are common sector practice, not statutory fixes — a business should document its own reasoning for each, proportionate to risk. Where a template borrows generic numbers without checking them against the actual law or the actual purpose, it becomes a liability rather than a defence.
Who is responsible for creating, approving and maintaining the policy?
Responsibility for a data retention policy sits with a named owner inside the business — typically a Data Protection Officer (DPO) where one is appointed, or a director with delegated responsibility where it isn't. UK GDPR requires public authorities and organisations engaged in large-scale monitoring to appoint a DPO; most SMEs assign the role to an operations director, compliance lead, or company secretary instead.
Ownership should be split across three functions in practice:
- Drafting — usually the DPO, compliance manager, or an external data protection consultant who understands both the legal minimums and the operational reality of each department.
- Approval — senior leadership or the board, since the policy carries financial and reputational exposure if wrong.
- Maintenance — a named individual tasked with reviewing the schedule at least annually, and immediately after any relevant legal change, such as the Data (Use and Access) Act 2026 reforms.
A policy with no named owner tends to drift out of date within a year. The ICO's enforcement history shows that "we had a policy" is rarely enough — investigators ask who last reviewed it and when.
How does a data retention policy differ from a data protection policy?
A data retention policy specifically governs how long data is kept and when it's deleted; a data protection policy covers the much broader set of obligations around how personal data is collected, used, secured and shared. The retention policy is one operational component that usually sits underneath the wider data protection policy or privacy policy.
| Aspect | Data retention policy | Data protection / privacy policy |
|---|---|---|
| Scope | Storage duration, deletion triggers | Lawful basis, data subject rights, security, transfers |
| Audience | Internal staff, compliance teams | Customers, data subjects, regulators |
| Primary question answered | "How long do we keep this, and when do we delete it?" | "What do we do with your data, and what are your rights?" |
| UK GDPR principle addressed | Storage limitation (Article 5(1)(e)) | All principles — lawfulness, fairness, transparency, accuracy, security |
Many businesses conflate the two and end up with a public privacy notice that says "we only keep data as long as necessary" with no internal document explaining what that actually means in days or years. Both documents need to exist, and they need to agree with each other.
What are the legal consequences of non-compliance?
Non-compliance with UK GDPR's storage limitation principle can result in regulatory fines, reputational damage, and increased exposure in data breach claims. UK GDPR fines can reach up to £17.5 million or 4% of global annual turnover for serious infringements, per Sprintlaw UK (2026).
The scale of recent enforcement shows this isn't theoretical. The ICO fined Capita plc and Capita Pension Solutions Limited £14 million for UK GDPR infringements following a 2023 cyberattack that compromised data belonging to 6,656,037 individuals, per Clifford Chance (2026) — a case that turned partly on how much legacy data the organisation was still holding at the point of the breach. The largest UK GDPR fine ever issued remains £20 million against British Airways in October 2020, per GDPR Course (2026).
The trend is upward, not settling. The ICO issued 14 monetary penalties totalling £21.7 million in 2026, averaging £1.6 million each, compared with 17 penalties totalling just £2.5 million in 2026, per Miller & Partner (2026). Reported breach volumes are climbing too — 3,600 personal data breach incidents were reported to the ICO in Q4 2026 alone, up 16% year on year, per GDPR Course (2026). Holding more data for longer simply increases the surface area exposed if a breach occurs.
For businesses that depend on public-sector or enterprise contracts, there's a second consequence that doesn't make the ICO's enforcement register: a weak retention policy is a pass/fail gate risk in formal tenders. Pulse Operations's guide, How to win your next security tender, notes that buyers screen bidders on GDPR policies before quality is even scored — a stale or generic retention document can lose a contract before price is considered.
What steps are involved in creating and implementing a policy from a template?
Implementing a data retention policy from a template runs through five practical stages: audit, map, draft, approve, and operationalise. Skipping the audit stage is the single most common reason templates fail in practice — a business adopts a generic document without checking it against what data it actually holds.
- Audit existing data — list every system, spreadsheet, and filing cabinet holding personal data, across HR, finance, operations, and customer-facing functions.
- Map each category to a lawful basis and retention trigger — contract end, employment termination, last transaction date, consent withdrawal.
- Draft the schedule using statutory minimums where they exist — HMRC's 6 years + current year default, PAYE's 3-year minimum, Companies Act provisions — and a documented, proportionate rationale everywhere else.
- Approve at board or senior leadership level, with sign-off recorded and dated.
- Operationalise it — build the deletion triggers into actual systems, train staff on the schedule, and set a recurring annual review date.
The operationalising step is where most businesses stall, because a retention schedule in a Word document doesn't delete anything by itself. Security and facilities operators in particular hold large volumes of operationally necessary personal data — officer records, DBS checks, incident logs, visitor sign-ins — and need the schedule tied to the system actually generating that data, not sitting separately in a compliance folder nobody opens.
What common mistakes do UK businesses make when drafting a retention policy?
The most common mistake is adopting a generic template without auditing actual data holdings first, which produces a document that doesn't match operational reality. Several other recurring errors show up across ICO enforcement history and audit findings:
- No named retention period at all — "as long as necessary" with nothing further is not a schedule.
- Confusing "review" with "destroy" — many schedules only state when data should be reviewed, with no clear instruction on what happens if the review decides to keep it, creating indefinite extensions by default.
- No legal hold process — when litigation, an FOI request, or a regulatory investigation is pending, standard deletion schedules must pause; few templates document how that pause is triggered or recorded.
- Treating CCTV and biometric data the same as paper HR files — these carry different proportionality expectations and shorter typical retention windows.
- No annual review — a policy drafted in 2022 and never revisited won't reflect the Data (Use and Access) Act 2026 reforms that took effect in 2026.
- No single owner — when three departments think someone else is responsible for deletion, nobody deletes anything.
Mo Hassan, Founder of Pulse, makes a related point about system changes generally that applies directly to retention: "Run the new system in parallel on one site before you switch anything off. We migrate the data, the officers learn the app on shift one, and nothing gets decommissioned until you're confident. Switching feels risky because vendors make it a leap — it should be a walk." The same discipline applies to retiring an old retention process — don't delete the old filing system until the new schedule is proven to capture everything it should.
How should data be securely deleted once the retention period ends?
Secure deletion means destroying personal data in a way that makes recovery impossible, appropriate to the format the data is held in. For digital records, this typically means cryptographic erasure or secure overwrite tools rather than a simple file deletion, which often leaves data recoverable. For paper records, cross-shredding or a certified confidential waste contractor is standard practice.
The ICO's guidance on retention and destruction of information stresses that deletion must be evidenced — a log showing what was deleted, when, and by whom, is part of demonstrating accountability under UK GDPR's Article 5(2). A business that can't show a deletion audit trail is in a similar position to one that can't show a retention schedule: unable to prove compliance even if it technically happened.
This is where a hash-chained, tamper-evident audit log earns its keep operationally. Pulse Operations's own platform records every action — including deletions and reviews — in a SHA-256 hash-chained log with a built-in integrity check that walks the whole chain, so an operator can demonstrate exactly what happened to a record and when, rather than relying on a spreadsheet nobody can verify after the fact.
Your data retention policy checklist
- Audit every system and location holding personal data across HR, finance, operations, and customer records.
- Map each data category to a specific Article 6 lawful basis.
- Apply HMRC's 6 years + current year default and the 3-year PAYE minimum where they apply, per GOV.UK (2026) and legislation.gov.uk (2015).
- Name a single accountable owner for drafting, approval and annual review.
- Document a legal hold process for pending litigation, FOI requests, or ICO investigations.
- Build deletion triggers into the actual systems generating the data, not a standalone document.
- Record every deletion in an auditable log, with date, record type, and method.
- Review the full policy annually and after any relevant legislative change, including the Data (Use and Access) Act 2026.
FAQ
What is a data retention policy and why does a UK business need one?
A data retention policy is a document that sets out how long an organisation keeps each category of personal data and when it's deleted. UK businesses need one to comply with UK GDPR's storage limitation principle and to evidence that compliance during an ICO audit.
Is a data retention policy a legal requirement under UK GDPR?
UK GDPR doesn't name "a retention policy" as a mandatory document by title, but it requires organisations to comply with storage limitation and to demonstrate accountability. In practice, the ICO expects a documented schedule, making a policy the standard way to meet that obligation.
How long should a business keep personal data under UK GDPR?
There's no single fixed period — UK GDPR requires retention only as long as necessary for the purpose. Specific statutory minimums apply to some record types, such as HMRC's 6 years + current year default and the 3-year minimum for PAYE records.
What is the difference between a retention policy and a retention schedule?
A retention policy is the overarching statement of principles and responsibilities; a retention schedule is the detailed table listing each data category, its retention period, and its deletion trigger. A policy without a schedule attached is rarely enough to satisfy an ICO investigation.
What happens if a company doesn't have a data retention policy?
A company without a retention policy risks ICO enforcement action, fines of up to £17.5 million or 4% of global turnover for serious infringements, and reputational damage. The ICO has previously found specifically that an organisation without a retention policy cannot ensure data isn't held longer than necessary.
How often should a data retention policy be reviewed?
Most organisations review their retention policy annually, and immediately after any relevant legal change, such as the Data (Use and Access) Act 2026 reforms that took effect on 5 February 2026. A policy left unreviewed for several years is a common finding in ICO audits.
Can personal data be kept indefinitely with consent?
Consent doesn't override the storage limitation principle — even with consent, data should only be kept as long as necessary for the stated purpose, and consent can be withdrawn at any time. Indefinite retention based solely on historic consent is a common and risky misunderstanding.
Building a defensible retention process with Pulse Operations
Security and facilities operators generate exactly the kind of personal data a retention policy has to cover — officer records, DBS checks, incident logs, visitor sign-ins, CCTV references, client correspondence — and a policy that isn't tied to the systems actually producing that data rarely survives contact with an ICO audit or a tender compliance gate. The compliance runway brings SIA licensing, BS 7858 screening records, DBS checks, right to work, training, and statutory building compliance onto a single expiries timeline, so retention and review dates sit against the record itself rather than a separate spreadsheet.
Every checkpoint, incident, and occurrence book entry inside Pulse Operations is logged in a SHA-256 hash-chained, tamper-evident audit trail with a built-in integrity check — the same mechanism that supports defensible deletion, because what happened to a record, and when, is provable rather than asserted.
If a messy retention process is costing you tender points or audit confidence, get in touch with Pulse Operations for a walk-through of the compliance runway and how it fits alongside your existing data retention policy.
Related Reading
- CCTV Policy Template UK: What It Must Include (2026)
- Body Worn Camera Policy Template UK (2026 Guide)
- Security Guard Handover Template UK | Free Guide 2026
Add pulse-operations.co.uk as a preferred source on Google
Back to all insights