Retention Periods
You must not keep personal information for longer than is necessary. Remember that even storing information is processing it, so if you keep information longer than you need to the processing is irrelevant and so contravenes the Act.
Most of the retention periods indicated below have a statutory basis and are minimum periods to satisfy the appropriate legislation. If you decide to retain personal information for longer than the periods indicated you must have a reason that is valid by reference to the Data Protection Principles.
Retention Summary Table
| Type of Personal Information | Minimum Retention Period | Reasons |
|---|---|---|
| Personnel files including training records and notes of disciplinary and grievance hearings. | 6 years from the end of employment. |
References and potential litigation. |
| Application forms/interview notes. | 6 months from the date of the interview. |
Time limits on litigation. |
| Income Tax and NI returns, including correspondence with tax office. | 3 years after the end of the financial year to which the records relate. | Income Tax (Employment) Regulations 1993. |
| Statutory Maternity Pay records and calculations. |
As above. | Statutory Maternity Pay (General) Regulations 1986. |
| Statutory Sick Pay records and calculations. | As above. | Statutory Sick Pay (General) Regulations 1982. |
| Wages and salary records. | 6 years. | Taxes Management Act 1970. |
| Accident books and records and reports of accidents. | 3 years after the date of the last entry. | RIDDOR 1985. |
| Health records. | During employment. | Management of Health and Safety at Work Regulations. |
| Health records where reason for termination of employment is connected with health, including stress related illness. | 3 years. | Limitation period for personal injury claims. |
|
Medical records kept by reason of the Control of Substances Hazardous to Health Regulations 1994. |
40 years. |
COSHHR 1994. |
|
Student records, including academic achievements and conduct. |
6 years from the date the student leaves the University, in case of litigation for negligence. 10 years for personal and academic references, with the agreement of the student. | Limitation period for negligence. |
| Contact details kept on personal files (e.g., card index, MS Outlook). | Until it is apparent that the person is no longer at the named location. | It is inaccurate processing if the information is held any longer. |
| Personal information of any sort on a web page/site. | No longer than a period specifically agreed with the person. | Danger of inaccurate and irrelevant processing. |
