ISO 27001 Control 5.33: Protection of Records

Alan Parker, ISO 27001 Consultant & Internal Auditor,
Helping UK SMEs hit ISO 27001 in 90 days.
B.Sc (Hons) Information Systems · Certified ISO 27001 Lead Auditor · CISMP · ITIL Expert · 30+ years in IT governance and security.
Read full bio →

Introduction

Ask an organisation how long it keeps its records and the honest answer is usually “forever”. Not because anyone decided that, but because nobody decided anything else. Files accumulate, inboxes grow, shared drives fill up with folders nobody has opened in years, and everything is kept just in case.

Control 5.33 is about protecting records: keeping them safe from loss, destruction, falsification and unauthorised access for as long as you need them. Most of the protection is handled by the rest of your ISMS. The part that is usually missing is the “for as long as you need them”, and what happens afterwards.

This page covers what the control requires, why keeping too much is the real problem, and how to build a retention schedule that people will actually follow. There is a free records retention schedule further down.

What control 5.33 actually asks for

The control requires records to be protected from loss, destruction, falsification, unauthorised access and unauthorised release. In practice that means:

• Knowing what records you hold. The categories that matter, who owns them and where they live.
• Knowing how long to keep each one. Based on legal, regulatory, contractual and business requirements.
• Protecting them while you keep them. From loss, from unauthorised change, and from people who should not see them. Records you will need in seven years must still be readable in seven years.
• Disposing of them when the time comes. Securely, on schedule, and with a record that you did.
• Pausing disposal when needed. If a dispute, investigation or claim arises, the relevant records must be kept until it is resolved.

In the 2013 edition this was control A.18.1.3. The control is about records in general, not only personal data, but where records contain personal data the retention rules overlap with control 5.34 and data protection law.

Keeping too much, not too little

I rarely find an organisation that has deleted records too soon. I constantly find organisations that keep everything.

It feels safe. What if we need it? But records kept beyond any reason to keep them are pure risk. They can be stolen in a breach, and every extra year of data makes a breach worse. They must be searched and disclosed in a subject access request. They can be produced in a dispute in ways you would rather they were not. And where they contain personal data, keeping them longer than necessary breaches the storage limitation principle in UK GDPR on its own, before anything else goes wrong.

The best example is recruitment. It is rare that I find an HR policy with a sensible retention period for unsuccessful candidates. CVs, application forms, interview notes and sometimes copies of ID sit in inboxes and shared folders for years. None of those people work for you. Most of them applied once, years ago. All of them are personal data you have no reason to hold. A retention period of around six months after the decision, and a routine that actually deletes them, removes a surprising amount of risk.

Building a retention schedule

A retention schedule lists the categories of record you hold and how long you keep each one. It does not need to list every document. For a small business, twenty to thirty lines usually covers it. The periods come from the requirements on your legal register under control 5.31, from your contracts, and from what the business genuinely needs.

The table below shows typical UK periods for some common records. It is a starting point, not legal advice; check current guidance for your own situation and sector.

For each line, the schedule should also say when the clock starts, who owns the record, where it is kept and how it is disposed of. “Six years” means nothing unless everyone agrees six years from what.

Making disposal actually happen

A retention schedule nobody acts on is just a document. The disposal step is where most organisations stop, so make it as automatic as possible.

• Use retention settings where they exist. Microsoft 365, Google Workspace and many HR and CRM systems can apply retention and deletion rules automatically. Set them once and they keep working.
• Diarise the rest. For records that cannot be automated, put a recurring review in the owner’s calendar, quarterly or annually.
• Deal with the inboxes. Shared recruitment and HR inboxes are where personal data accumulates fastest. Give them retention rules or a regular clear-out.
• Dispose of things securely. Deletion from the system, shredding for paper, and secure wiping or destruction for old devices under control 7.14.
• Record it. A line in a log saying what category was disposed of and when is enough. It is your evidence.

And have a way to stop it. If a claim, dispute or investigation arises, the owner of the relevant records needs to know to suspend disposal until it is resolved. A single sentence in the schedule and a named person to tell is usually enough for a small business.

Protecting the records you keep

The other half of the control is protecting records for as long as you hold them. Most of this is done by controls elsewhere in your ISMS, so the job under 5.33 is mainly to check they cover your records.

• Loss and destruction. Backups under control 8.13, and for long-lived records, making sure the format will still be readable. A record kept for six years in a system you retire in year three is not protected.
• Falsification. Records that may be relied on as evidence, such as financial records, signed contracts, audit logs and incident records, should be protected from alteration. Version history, restricted edit rights and write-once storage all help.
• Unauthorised access and release. Access control under control 5.15, so HR and finance records are only open to the people who need them.

What auditors will look for

As a Lead Auditor, this is broadly how I would work through 5.33.

1. The retention schedule. Does it exist, and do its periods trace back to legal, contractual or business requirements?
2. A category, checked. I will pick one, often recruitment records, and look at what is actually held. If the schedule says six months and the inbox goes back five years, that is the finding.
3. Disposal. How does disposal happen, and is there any record of it?
4. Protection. For records that matter as evidence, how are they protected from change? Who can edit the finance records?
5. Long-term readability. For records kept for years, will they still be accessible when needed?
6. Legal holds. If a dispute arose, how would disposal be suspended?

Common issues

• No retention schedule, and everything kept indefinitely.
• A schedule that exists but is never applied, with records years past their date.
• CVs and interview notes for unsuccessful candidates kept for years in shared inboxes.
• Periods with no clear start point, so nobody knows when anything is due.
• Retention settings available in the systems in use, and never switched on.
• Records needed as evidence that anyone can edit.
• Old systems retired with records still in them, and no way to read them.

The self-check

Five questions. If you cannot answer them today, an auditor will find that out for you.

• How long do you keep CVs from candidates you did not hire, and how many years of them are in your inboxes right now?
• Does every category in your retention schedule say how long, from when and who owns it?
• When did you last delete anything because its retention period had expired?
• Which of your systems has retention settings you have not used?
• If a former employee raised a claim tomorrow, how would you make sure the relevant records were not deleted?

The first and third are the ones to sit with. They show whether the schedule is a working document or a good intention.

A worked example

The details below are typical rather than drawn from a single engagement. This is a composite of a first look at 5.33 in a business of this size.

A 40-person services business on Microsoft 365, with a cloud HR system and a shared recruitment inbox. It had a data protection policy saying records were kept “no longer than necessary”, and no retention schedule.

What the review found

• The recruitment inbox held over 2,000 applications going back seven years, many with CVs and some with copies of passports.
• Former employees’ HR records were all still in the HR system, including people who had left a decade earlier.
• Microsoft 365 retention policies were available under the existing licence and had never been configured.
• Signed customer contracts lived in a shared folder that every member of staff could edit.

What changed

• A retention schedule of 24 categories, each with a period, start point, owner and disposal method.
• Recruitment records over six months old deleted, and a retention rule applied to the inbox so it stays that way.
• Former employee records reviewed and disposed of in line with the schedule, with the disposal logged.
• Retention policies configured in Microsoft 365 for the main record categories.
• Signed contracts moved to a folder with read-only access for most staff.

The clean-up took about two days. The ongoing effort is close to nothing, because the systems now do most of it. The business holds far less personal data than it did, and a breach today would expose a fraction of what it once could have.

How control 5.33 links to other clauses and controls

• Control 5.31, Legal, statutory, regulatory and contractual requirements. Where most retention periods come from.
• Control 5.34, Privacy and protection of PII. Personal data must not be kept longer than necessary. Your schedule and your ROPA should agree.
• Control 5.15, Access control. Protecting records from unauthorised access and change.
• Control 8.10, Information deletion. Disposal at the end of the retention period.
• Control 8.13, Information backup. Protecting records from loss. Backups should follow retention too.
• Control 8.15, Logging. Logs are records, with their own retention period.
• Control 7.14, Secure disposal or re-use of equipment. Records on old devices need disposing of as well.
• Clause 7.5, Documented information. The ISMS’s own records need retention and protection like any other.

What I find in audits

Very few of the roughly 30 organisations I have audited or implemented ISO 27001 for since 2024 had automatic deletion switched on in any system, so records are kept long after their retention period has passed. More detail is in my findings report.

Frequently asked questions

Sources and further reading

Official legislation, standards and guidance referred to on this page.

• Principle (e): Storage limitation. ICO guidance on not keeping personal data longer than you need it.
• Company and accounting records. GOV.UK guidance on how long to keep company and accounting records.
• PAYE and payroll for employers: keeping records. GOV.UK guidance on payroll record retention.
• Right to work checks: an employer’s guide. Home Office guidance, including how long to keep copies of documents.
• Employment information. ICO guidance on handling workers’ and candidates’ personal data.
• ISO/IEC 27001:2022, Information security management systems. The standard itself, published by ISO.

Internal Audit Service

Get an independent view of your ISO 27001 ISMS before you go into an audit.

“Alan from Iseo Blue truly came to our rescue. His support ahead of our internal audit was outstanding, and he helped us get our ISMS 100% ready for the Phase 2 audit.“

– Quartile.

✓ Gain confidence
✓ Audit plan
✓ Independent view
✓ An ISO 27001 requirement

✓ Audit findings report
✓ Recommendations
✓ Review meeting
✓ Fixed price

£2,500

+ VAT where applicable

View DetailsBook a discovery call