Data Retention Policy and Schedule template

About this document

What it’s for

A policy that sets out how your organisation decides how long to keep records, how it reviews and securely destroys them, and how it handles legal holds – plus a ready-made retention schedule of over 70 common record types, each with its legal source or the reason for the period. It helps you meet the storage limitation principle in the UK GDPR and the many statutory record-keeping rules.

When to use it

When setting up or tidying your records, systems and shared drives
To answer “how long do we keep this?” consistently across the organisation
To support your privacy notices, which must state retention periods

What’s inside

The document is laid out in the sections below. Each one comes with a plain-English guidance note explaining what it does and what to change.

Purpose
Scope
Definitions
Principles
Roles and responsibilities
Storing records during the retention period
Review and disposal
Legal holds
Requests from individuals
Annual review
Training, compliance and related documents
Purpose
Scope
Definitions
Principles
Roles and responsibilities
Storing records during the retention period
Review and disposal
Legal holds
Requests from individuals
Annual review
Training, compliance and related documents

Also included

Part 1 – Policy
Part 2 – How to use the Schedule
Table 1 – Company and governance [OWNER: [COMPANY SECRETARY / DIRECTOR]]
Table 2 – Finance and tax [OWNER: [FINANCE MANAGER]]
Table 3 – Recruitment and employment [OWNER: [HR MANAGER]]
Table 4 – Health and safety [OWNER: [HEALTH AND SAFETY LEAD]]
Table 5 – Customers, sales and marketing [OWNER: [SALES / MARKETING MANAGER]]
Table 6 – Suppliers, property and IT [OWNER: [OPERATIONS / IT MANAGER]]
Table 7 – Data protection records [OWNER: [DATA PROTECTION LEAD]]
Table 8 – Sector-specific records [ADD AS NEEDED]
Appendix A – Record of destruction

How to complete it

Assign an owner for each area of the schedule
Delete rows that do not apply and add sector-specific records
Where a period is a recommendation rather than a legal requirement, decide what suits you and note your reason
Set an annual review date and keep destruction records using Appendix A

Key points to check

Statutory periods change – check the sources marked [CHECK] before relying on them
Scotland and Northern Ireland have different limitation periods (see the note to Part 3)
Regulated sectors (for example financial services, care, legal) often have longer periods

Our templates are professionally structured starting points for UK businesses, not legal advice. For anything complex, unusual or high-value, have your final version checked by a solicitor.

Included in the pack

Data protection & GDPR

£20

for every document in this category

Editable Microsoft Word files

Guidance notes in every document

Written for UK businesses

Download and keep

Get the pack See every document in this pack →

Need more than one category?

Documents All-Access gives you every category for 12 months for £295.

Compare options →

Need it tailored?

We can adapt any template to your business, or write a document from scratch.

Talk to us →

Data Retention Policy and Schedule

What it’s for

When to use it

What’s inside

Also included

How to complete it

Key points to check

Get In Touch

Quick Links

Company information

Legal