Data Retention and Breach Response Policy

DATA RETENTION AND BREACH RESPONSE POLICY

____________________ LTD (the “Company”) Version ____ Effective ______________ Policy owner: ____________________

1. Purpose and scope

1.1 This policy sets out how long the Company keeps personal data and other records, how it deletes them securely, and how it responds to a personal data breach. It applies to everyone who works for the Company (“you”) and to all records held by or for the Company in any form.

1.2 The Policy Owner is responsible for this policy and for the records of processing. A person is named in Schedule 2 to lead a breach response (the “Breach Lead”) with a deputy.

2. Retention

2.1 The Company keeps personal data and records only for as long as needed for the purpose for which they were collected, to meet legal, accounting or regulatory requirements, or to establish, bring or defend legal claims. The retention periods are in Schedule 1. When there is no specific period, data is kept for no longer than ____ years (suggested: 2 to 3) after the last activity.

2.2 If the Company has a legal hold (for example, a dispute, regulatory investigation or claim is reasonably expected), records relating to it must not be deleted until the Policy Owner releases the hold, even if the retention period has ended.

2.3 Everyone must: save business records in approved systems (not personal accounts or devices); avoid keeping copies of data in e-mail, local drives or messaging apps beyond what is needed; and delete drafts and duplicates promptly.

2.4 Data is reviewed at least once a year, and deleted or anonymised once the period has ended. Deletion must be secure: permanent deletion from systems and back-ups (in the normal back-up cycle, not later than ____ days after deletion, suggested: 90), shredding of paper, and certified wiping or destruction of devices. Keep a log of significant deletions.