Data Retention Policy

Scope

1. This policy covers the data that CCW creates, receives, or maintains.

2. The effective management of the information we hold is important for a number of reasons:

• enables us to know exactly what information we hold and locate it easily;
• enables us to comply with information requests on a timely basis;
• enables us to comply with relevant legislation including the Freedom of Information Act 2000, the UK GDPR, pension regulations and financial regulations.
• Only holding the information we need to saves money and space (both physical and virtual)

Retention policy

3. Information should only be kept for as long as there is an administrative need to keep it to carry out CCW’s business or support functions, or for as long as it is required to demonstrate compliance for audit purposes or for legislative requirements. The retention schedule at Annex A is a control document that sets out the periods for which certain records should be kept to meet operational needs and comply with legal and other requirements.

4. The retention schedule sets out the period the types of data held by CCW must be kept for unless there is a legal requirement to destroy it sooner. All members of staff have a general responsibility to manage the data they are responsible for, the following individuals have particular responsibilities in relation to the retention and disposal of information:

Information Asset Owners (IAO)

IAOs ensure that the information assets under their control are managed in line with the retention schedule at Annex A.

Local Information Management Officer (LIMO)

IAOs may decide to allocate the role of LIMO to particular staff. LIMO are responsible for monitoring compliance with the retention schedule.

All staff

All staff have a duty to manage the information and data they are responsible for.

5. Retention periods are driven by legislation and/or business need. If there is no statutory retention period for an item it is the responsibility of the relevant IAO in consultation with the Data Protection Officer to determine an appropriate period.

6. Retention periods are set out in the attached schedule and comprise three elements:

1. trigger – the action/point at which the retention period starts (eg end of financial year, end of employment)
2. retention period – the length of time the information will be kept
3. action – the action that will take place at the end of the retention period (either review or destroy)
   • Where the action is review the information must be reviewed to check it is no longer required before destruction. Outcomes of the review may be destroy, mark for permanent preservation, temporary extension to review at a future date (see paragraph 10)
   • Where the action is destroy the information may be destroyed without further review

Weeding

7. Not all information that CCW creates has long term value. The retention schedule does not include information that is redundant, obsolete or trivial. This information should be destroyed by teams and individuals as part of routine housekeeping. Information that is included in the schedule should only be deleted when it reaches the end of the retention period (see paragraph 12).

8. Examples of information that is often of limited value and may be weeded are:

• Draft documents can become obsolete once a final version has been published and may be weeded. There may be occasions where significant changes have been made and a draft may be retained to demonstrate how a final decision has been made.
• Where e-mails contain important information should be saved to CCW’s file structure eg to evidence decisions or actions taken. When e-mail conversation develops into a chain earlier messages can be deleted.
• Retaining duplicates can cause confusion and take up space. For example papers for the Board and Executive Team are held centrally, copies do not to be held locally in the long term.
• Research material such as copies of guidance obtained from third parties to aid the development a corporate policy have limited value when the final policy has been created and so may be deleted.
• Some items such as attendance sheets for past events have limited long term operational value and should be weeded as soon as they are no longer required.

9. Weeding should be carried out regularly to ensure prevent clutter building up. IAOs should encourage colleagues to carry out regular weeding including personal drives.

Reviewing Information

10. Documentation may be marked review in the retention schedule. In these cases the information must be reviewed by the IAO to decide of it can be destroyed. The following factors should be taken into account in a review:

• Is the information required to fulfil statutory or regulatory requirements
• Is the information relevant to ongoing litigation
• Is the information the subject of an information request or relate to information recently disclosed in a response
• Is the information required to evidence events in the case of a dispute
• Is there another demonstrable business need for retaining the information

11. If the information is deemed to be still required the retention period for the item should be extended by two years and reviewed again after two years. Extension periods should not be extended indefinitely.

Destruction

12. When information is no longer required and does not have an archival value it should be securely destroyed. Destruction of records included in the Retention Schedule should not proceed without the approval of the relevant IAO.

13. For example, hard copy records including special category data or which are protectively marked should be securely destroyed. When information is destroyed, all copies of the information (both digital and physical) should be destroyed at the same time.

Permanent Preservation

13. Any documents marked for permanent preservation must not be destroyed. This is only likely to include Board papers [work will start shortly to clarify this].

Policy Review

14. This policy and schedule will be reviewed at least every two years. The review will be coordinated by the DPO with input from the IAOs.

ANNEX A: Retention Schedule

1. Board / Committees

2. Governance

3. Consumer Relations

4. Communications

5. Policy / Research

6. Finance, Procurement and Facilities

7. IT

8. HR / Transformation

9. Project

10. Organisation wide

• Review frequency: 2 years
• Last approved: December 2023
• Next review: December 2025
• Approved by: Executive Team