Data Retention & Records Management Compliance Check

Why this matters

UK GDPR Article 5(1)(e) says personal data must be kept “no longer than is necessary” for the purpose it was collected, and Article 5(2) makes the business responsible for being able to prove it. In practice that means a documented retention schedule, a clear owner, and a process that actually deletes or anonymises data when the clock runs out. Breaching the core principles in Article 5 can attract fines of up to £17.5 million or 4% of annual worldwide turnover, whichever is higher, under the Data Protection Act 2018. The ICO regularly finds that organisations keep old customer lists, CVs, CCTV footage and former-employee files “just in case” — which is exactly the pattern that turns a small breach into a large one, because old data is still data you have to protect and disclose in a subject access request. Deleting too early is a risk as well. HMRC expects business records to be kept for at least six years under the Taxes Management Act 1970 and VAT Act 1994, private companies must keep accounting records for at least three years under the Companies Act 2006, and employers must hold payroll, statutory pay, working-time and right-to-work records for set periods. Claims for breach of contract can be brought up to six years later under the Limitation Act 1980. The Data (Use and Access) Act 2025 has updated parts of UK data protection law but has not removed the storage limitation principle. A sensible retention policy balances both sides: keep what the law and your legitimate needs require, and securely dispose of everything else.

What you'll need

• Whether you hold personal data about customers, employees, job applicants or suppliers
• Whether you have a written retention schedule or records management policy
• Where data is stored (cloud systems, email, paper files, backups, personal devices)
• Whether anyone is responsible for deleting or archiving old records
• Whether you are subject to sector-specific retention rules (e.g. financial services, healthcare, construction)

What you'll get

A personalised compliance report covering: a score out of 100, an executive summary, a list of findings ranked by severity, and a prioritised action plan with timeframes.