GDPR.ME.UK · WORKING DOCUMENT 72

Retention, deletion and legal-hold protocol

Set a reasoned schedule by record class, with a clear trigger and disposal method. Distinguish legal minimum periods, regulatory guidance, limitation considerations and the organisation’s own justified policy.

Document edition 2 · 1 November 2026 · Adapt to your processing and evidence. Use references rather than personal records.

Record details

Organisation or activity reference

Responsible owner or role

Record reference and version

Review date

1. Inventory record classes

Group information by purpose and record type. Separate clinical, financial, HR, client, notarial and other records where the rules differ.
Identify all repositories, including paper, exports, email, supplier systems and backups.
Record the owner and who may approve deletion or a retention exception.

Record class / purpose / data categories

Jurisdiction and sector

Business owner and disposal approver

Systems / locations / supplier copies

Sensitive information and access

Relevant processing activity ID

2. Set the retention decision

Specify the start event, period, rationale, authority, exceptions and review date. Examples of triggers include case closure, last treatment or financial-year end; choose the correct event for the record.
Do not turn a limitation period into a blanket retention duty. Check whether a legal minimum is sufficient and whether keeping longer is justified.
For specialist records verify the full current rule. Notarial public-form and private-form records have distinct requirements under Rule 24 of the 2019 Rules; NHS England guidance has scope and record-specific exceptions.

Retention trigger and period

Legal minimum / guidance / policy classification

Source URL and provision

Need for any longer period

Exceptions and review conditions

Approval and next review date

3. Operate deletion or anonymisation

Specify how the event is detected, how eligible records are selected and who checks the deletion list.
Check linked records, legal holds, erasure requests, supplier copies and exports before disposal.
Define the deletion or irreversible anonymisation method and retain proportionate evidence without retaining the deleted personal information unnecessarily.

Eligibility query or manual selection method

Pre-deletion checks and sign-off

Deletion / anonymisation method

Systems and suppliers covered

Batch / date / operator / result

Exceptions and failure resolution

4. Control backups and legacy copies

Record backup rotation and restoration arrangements. Restrict use of information awaiting expiry and prevent it returning to ordinary use after restoration.
Check legacy media, shared drives and uncontrolled exports; allocate remediation where deletion cannot yet be completed.
Explain any delayed disposal, its limits, access controls and planned completion date.

Backup / archive / legacy repository

Rotation and disposal cycle

Access restriction while awaiting deletion

Restore-and-reapply-deletion procedure

Technical limitation and mitigation

Owner / completion date / evidence

5. Place, review and release a legal hold

Record the basis for preserving identified information, including relevant litigation, investigation or legal duties. Define a proportionate scope.
Notify custodians and system owners, suspend relevant routine deletion and document confirmation.
Review the continuing need. Release only on authorised instruction, then reapply the schedule; do not retain held material indefinitely by default.

Hold ID / reason / authority

Record scope / custodians / systems

Start date and notifications

Approver and review date

Access and security restrictions

Release instruction / date / disposal follow-up

6. Verify and maintain

Sample a disposal path and record whether copies remain in ordinary use. Reconcile notices and ROPA with the approved schedule.
Review changes to law, services, record classes and supplier capabilities.
Track overdue actions and report systemic problems to the accountable owner.

Sample and test outcome

Disposal evidence reference

Notice / ROPA changes

Overdue exceptions and actions

Review owner and date

Version history

Sources and completion

Record who reviewed and approved the document. Save a working copy to reopen it later, or export the completed HTML record. Your entries stay in this page; automatic storage is not enabled. A downloaded record may contain sensitive operational information.

The template does not verify facts, perform an audit, submit a notification or execute a contract.