Appropriate policy document
Principle 5 - retained no longer than necessary
Personal data shall be kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed:
- we will keep personal data in identifiable form only as long as is necessary for the purposes for which it is collected, unless required otherwise by law
- once no longer needed, personal data shall be securely deleted or rendered permanently anonymous
- personal data is held and disposed of in line with our retention and disposal schedule. Retention periods are based on legal requirements to retain data and consideration of the needs of data subjects through data protection impact assessments