Data Retention Policy: What to Include and How to Write One

A data retention policy is a written rule set that says how long your organisation keeps each type of information, why, and what happens when the time is up. Under GDPR it is the practical way to meet the storage limitation principle: keep personal data only as long as you need it, then erase or anonymise it. This guide shows what the policy should contain, how to choose retention periods, how to handle deletion in backups and with suppliers, and what evidence shows the policy is followed.

What a data retention policy is and why you need one

A data retention policy is an organisation’s established protocol for keeping information for operational or regulatory reasons. TechTarget describes it as setting out the business reasons for keeping specific data and what to do with it once it is targeted for disposal. You may also see it called a records retention policy or a document retention policy.

Three needs drive it.

1. Legal duty. The European Commission lists the GDPR principles that bear on retention: purpose limitation, data minimisation, storage limitation, accuracy, integrity and confidentiality, and accountability. Without a policy you cannot show you apply them.
2. Risk. Data you no longer need still has to be secured, searched when someone makes an access request, and reported on if there is a breach. Less data held means less exposure.
3. Customer and audit expectations. Customers, auditors and regulators ask how long you keep data. A written schedule gives you a consistent answer.

The Commission frames retention as a decision about purpose and necessity. It is not a blanket period applied to everything.

Policy, schedule and procedure: three documents with different jobs

Most confusion comes from mixing these up.

The policy changes rarely. The schedule changes whenever a process, a system or a law changes. The procedure sits close to your IT and operations teams.

Which laws and standards shape your retention periods

Start with data protection law, then add the sector and national rules that set minimum periods.

GDPR and UK GDPR

The European Commission points to Article 5 (including storage limitation and accountability), Article 25 on data protection by design and by default, and Article 89 safeguards for qualifying archiving or research. It also tells organisations to check national labour, tax and anti-fraud laws, and to establish time limits to erase or review data. Read the Commission’s principles page first.

For UK readers, the ICO’s storage limitation guidance says retention periods must be justifiable by reference to your purposes, and that UK GDPR does not prescribe a universal period. The same logic applies across the EU.

Minimum periods set by other laws

Some records have a legal floor. Examples that readers often ask about:

• UK limited companies: GOV.UK states that accounting records must be kept for six years from the end of the last financial year they relate to. Longer periods apply in specified cases, such as multi-period transactions, long-lived assets, late tax returns or an HMRC compliance check.
• Aggregates Levy: GOV.UK guidance says to keep business records for six years and to obtain HMRC’s agreement before destroying records less than six years old.
• Spain: the Spanish Tax Agency explains that Article 30 of the Commercial Code requires books, correspondence and supporting records to be kept for six years from the last book entry, separate from the four-year tax assessment limitation period.

So the answer to “which records need to be kept for six years?” is: it depends on the record type and the country. Six years is common for company accounting and tax records in the UK and Spain, and it is not a rule for all records. Each EU member state sets its own periods, so check the national law for every country where you operate.

Information security standards

If you work towards ISO 27001, your retention rules also support the controls on information deletion and on records. Auditors look for a documented rule, evidence that it runs, and evidence that someone reviews it. Our page on supported standards shows how ISO 27001, GDPR, NIS2 and DORA requirements can be managed together.

How to set retention periods, step by step

The ICO advises identifying the personal data you hold and why you need it, then documenting standard periods for each category wherever possible. In practice that becomes six steps.

1. Inventory what you hold

List the data by function, data type or country. The Data Protection Network recommends first understanding what personal data you process and why, then categorising it along a dimension that suits the business. HR, finance, sales, support and product data are common starting groups.

2. Record the purpose for each category

A period has to be justified by a purpose. Ireland’s University College Dublin guidance (June 2026) says retention limits should be recorded for each processing purpose and included in privacy information. Where an exact period is not feasible, give the criteria used to decide it.

3. Identify legal minimums and maximums

Check employment, tax, company, anti-fraud and sector law, and any product warranty periods. A legal minimum gives you the floor for that category. Without one, set the shortest period that still serves the purpose.

4. Choose a trigger and a duration

Vague wording leads to inconsistent practice. The Filers Keepers guide recommends naming the triggering event and the exact duration, and specifying which fields or records are covered, instead of phrases like “current plus ten years”. Good triggers are “contract end”, “end of the financial year”, “employee leaving date” or “last customer contact”.

5. Define the end action

Each entry says what happens at expiry: delete, anonymise, or move to archive for a defined further period. The Data Protection Network says each schedule entry should state a period for each data asset, be communicated to stakeholders, data owners and processors, and define what happens at expiry.

6. Assign an owner and a review date

The ICO’s records management toolkit lists as control measures that storage periods are documented in a schedule, that the schedule is reviewed regularly, and that an appropriate staff member owns the schedule and process. It also warns that changing a process without updating the schedule can leave data held for the wrong period.

Example retention schedule layout

The table shows the structure only. The periods are placeholders that you must replace with figures justified by your own purposes and the law in your country.

Two features make this schedule usable. Every row has a named owner, and every row has a trigger that a person or a system can actually detect.

What a data retention policy template should include

A template is only a starting point, but a sound one has these sections:

1. Purpose and scope. Which entities, systems and data are covered, in both physical and digital formats. Ireland’s Data Protection Commission says a retention policy should cover both physical and digital formats, identify retention periods, and specify deletion or anonymisation measures.
2. Principles. Storage limitation, data minimisation, purpose limitation and accountability, in plain language.
3. Roles. Who owns the policy, who owns each category, and who carries out deletion.
4. Retention schedule. Attached or linked, with the columns shown above.
5. Deletion and anonymisation methods. Covered in the next section.
6. Exceptions. Legal holds, investigations, disputes and regulator requests that pause deletion, and who authorises them.
7. Processors and suppliers. How their retention and return of data is controlled by contract.
8. Records of processing link. UCD’s guidance says Article 30 records of processing should include retention time limits for different data categories where possible, so keep the two documents consistent.
9. Review and version control. Review frequency, approval and change history.

If you buy a template, adapt every period. A copied period that you cannot justify is a weakness, not a safeguard.

Deleting, anonymising and archiving when the period ends

The policy fails if expiry does not lead to action. Four points matter.

Use the retention cycle. The French regulator CNIL describes a cycle that may comprise active use, intermediate archiving, and final archiving or deletion. CNIL says archived data should not remain in active databases, and that access to intermediate archives should be restricted and exceptional.

Delete or anonymise properly. UCD’s guidance says expired data should be securely deleted, securely destroyed or fully anonymised, and that anonymisation must permanently sever links to identifying keys or source data. If a dataset can be re-identified by joining it to another, it has not been anonymised.

Cover backups and every location. The same guidance lists secure electronic deletion from systems, cloud storage, local drives and associated backups. It adds that cryptographic erasure can make data unrecoverable by securely deleting the encryption keys. Write down how long backups live and how deletion reaches them.

Align with erasure requests. CNIL recommends aligning purging or anonymisation with the mechanism you use for erasure rights where possible. One tested process is easier to run and to evidence than two.

For data held by suppliers, make the deletion duty part of the contract. Your data processing agreement should say what the processor does with data at the end of the service, and ideally you hold the same expectation of every supplier. Our exit and data portability terms show how that topic is handled for Guardiso customers.

Digital systems and the retention schedule

Most organisations now hold records across email, cloud storage, ticketing, HR and finance tools. Your schedule has to name those systems, because a rule that exists only on paper will not delete anything in a SaaS tool. Where a platform offers configurable retention or automatic expiry, record the setting in the schedule. Where it does not, record the manual step and who performs it. For a sector example of how digital records raise these questions, see this guide to digital social care records.

Guardiso also publishes how it handles data structures and formats and security measures, which is useful reading when you document what your own suppliers do.

Evidence that your policy is followed

A policy shows intent. Auditors and regulators want to see that it runs. The ICO’s toolkit suggests options such as an automated system that tags records with a retention date and prompts action at that date, and publishing the schedule. Based on those control measures, the following records make a convincing file:

• The approved policy and schedule, with version history and the name of the owner.
• Minutes or tickets showing the regular schedule review.
• Deletion logs or certificates showing what was removed, when, by whom and from which systems.
• Confirmation from processors that data was deleted or returned at contract end.
• Records of exceptions, such as legal holds, with approval and release dates.
• Evidence that staff know the rules, such as training or acknowledgement records.

Collecting these by hand before every audit takes time. A compliance platform keeps documents, owners and evidence in one place, which makes the file easier to assemble.

How Guardiso supports retention work

Guardiso is a platform for managing information security and regulatory compliance. In one system you can run ISO 27001, GDPR, NIS2, DORA and your own standards, with one set of documents and evidence serving many requirements. It provides document and policy templates, risk and evidence registers, audit planning and evidence collection through integrations with tools such as Microsoft 365, GitHub and AWS. Before an audit it prepares an evidence pack for the auditor. Data is stored only in the European Union, and Guardiso is an ISO 27001 certified company.

Plans start with Starter at €199 per month and Professional at €499 per month, and Enterprise is available on request. See Guardiso pricing to compare them, or read how the platform handles integrations and evidence. If you want expert help with the policy itself, our virtual security officer service is one route.

Common mistakes to avoid

• One period for everything. The ICO says periods must be justifiable by purpose, so a single blanket figure rarely holds up.
• Keeping data “just in case”. That is not a purpose. Write the actual reason or delete.
• Forgetting backups and processors. Deletion that stops at the live system leaves copies behind.
• No trigger. A period without a start event cannot be applied.
• No owner. A schedule nobody owns is not reviewed, and the ICO lists ownership and review as control measures.
• Ignoring national law. Minimum periods differ between countries, as the six year examples above show.

FAQ

What does a retention policy mean?

It is a written rule on how long you keep each kind of information, why, and how you dispose of it afterwards. It supports GDPR storage limitation and gives staff and auditors one consistent reference.

Can I use a data retention policy template?

Yes, as a structure. Use the sections listed above, then replace every period with one you can justify by purpose and by the law of the countries where you operate. Attach a retention schedule and name an owner for each category.

What records need to be kept for six years?

In the UK, limited companies must keep accounting records for six years from the end of the last relevant financial year, with longer periods in some cases. Spain also sets six years for commercial books and supporting records. Other records and countries differ, so check the specific law.

Does GDPR set a maximum retention period?

No single period is set. The regulators say you must keep personal data for the shortest time compatible with your purpose and legal obligations, then erase or anonymise it, and be able to justify the period you chose.

Sources

• What is a data retention policy? | TechTarget
• Principles of the GDPR | European Commission
• Principle (e): Storage limitation | ICO
• Retention | ICO records management toolkit
• Running a limited company: company and accounting records | GOV.UK
• Keeping records for Aggregates Levy | GOV.UK
• Accounting and registration obligations | Spanish Tax Agency
• Data Retention Guidance | Data Protection Network
• General Data Retention Guidance for Personal Data | UCD
• Sheet n°14: Define a data retention period | CNIL
• Data Security Guidance for Micro Enterprises | Data Protection Commission
• A practical guide to implementing a data retention policy | Filers Keepers
• Digital social care records guide | Weave

Recommended

• Acceptable Use Policy
• Exit and Data Portability Terms