Data Retention Policy

Purpose

This policy establishes how the Union manages, retains, archives, and securely disposes of records and personal data in compliance with:

• UK General Data Protection Regulation (UK GDPR)
• Data Protection Act 2018
• Companies Act 2006 (where applicable)
• Charities Act 2011 (where applicable)
• HMRC recordkeeping requirements
• Employment legislation

The Union shall not retain personal data for longer than necessary for the purposes for which it was collected.

Scope

This Policy applies to all information the Union holds and collects, including:

• Electronic records;
• Paper records;
• Email correspondence;
• Databases and management systems;
• Audio, video, and photographic records;
• Records held by staff, officers, trustees, volunteers, and contractors acting on behalf of the Union.

This policy applies to:

• Employees;
• Elected Officers;
• Trustees;
• Student Representatives;
• Community Leaders;
• Volunteers;
• Contractors and Consultants;
• Agency Workers;
• Third Parties processing personal data on behalf of the Union.

Principles of Data Retention

The Union will:

• Maintain records only as long as necessary;
• Retain records to meet legal, regulatory, operational, and evidential requirements;
• Securely dispose of records when retention periods expire;
• Suspend destruction where records are subject to litigation, investigation, complaint, insurance claim, audit, or data access request;
• Keep records of disposal activities where appropriate.

Subject Access Requests and Information Rights

Where a Data Subject Access Request (DSAR), complaint, legal claim, or regulatory investigation is received:

• Relevant records must be preserved;
• Scheduled destruction must be suspended;
• Records shall be retained until the matter is concluded and any appeal period has expired.

Disposal Procedures

Paper records shall be:

• Cross-cut shredded; or
• Disposed of using an approved confidential waste contractor.

Electronic records shall be:

• Securely deleted;
• Removed from active systems where technically feasible;
• Destroyed in accordance with the Union’s information security policy.

Roles and Responsibilities

Board of Trustees

The Board of Trustees has overall responsibility for ensuring that appropriate governance arrangements are in place to support compliance with data protection legislation and policies.

Chief Executive Officer

The Chief Executive Officer is accountable for ensuring that adequate resources, systems and controls are in place to support compliance with this Policy.

Data Protection Officer

The Data Protection Officer shall provide independent advice and guidance on data protection matters, monitor compliance, support risk management activities and act as the primary contact for regulatory authorities.

Managers

Managers are responsible for ensuring that personal data within their areas of responsibility is processed in accordance with this Policy and associated procedures.

Staff, Officers, Trustees & Volunteers

All individuals acting on behalf of the Union are responsible for:

• Complying with this Policy;
• Completing required training;
• Protecting personal data;
• Reporting data protection concerns and incidents promptly; and
• Cooperating with compliance and audit activities.

Related Documentation

The Policy should be read in conjunction with the following policy & guidance documentation:

• Privacy Notice(s)
• Records of Processing Activity
• Data Protection Policy
• Information Security Policy
• Data Protection Guidance documents and processes found on the Union How-To pages

Retention Schedule

Retention for data that we collect is outlined within our Records of Processing Activity. Our generalised retention is:

• 6 Years for student data to ensure accessibility throughout their University journey
• 6 Years for financial records, including payroll and tax records as required by HMRC

Where there is not a requirement in place, we will only retain data for as long as necessary.