Information Security Management
Data Retention Policy: How to Write One for ISO 27001 and UK GDPR, With a Free Template
A data retention policy says how long you keep each type of information and what happens to it when that time is up. Two sets of rules make it necessary for a UK business: ISO 27001, which requires records to be protected and information to be deleted when no longer required, and UK GDPR, whose storage limitation principle says personal data must not be kept longer than needed. Most small businesses have neither a policy nor a schedule; they have whatever is on the file server, going back to whenever the file server was set up.
The complete toolkit, every policy, template and record you need. Free, no commitment
This guide covers what ISO 27001 asks for, what UK law adds, how to build the retention schedule that is the real substance of the policy, how to deal with backups (the part everyone gets stuck on), and the template from our toolkit.
Free data retention policy template (Word)
The template has the purpose, scope and legal basis sections, the retention principles, the backup and archive approach, an exceptions process, and a retention schedule table with example rows to replace with your own. It is written for a UK business and references UK GDPR and the Data Protection Act 2018.
It is one of 18 policy templates in the free ISO 27001 toolkit.
What ISO 27001 requires
No single control says “have a data retention policy”. Four of them together make one unavoidable:
- 5.33 Protection of records. Records must be protected from loss, destruction, falsification, unauthorised access and unauthorised release, in line with legal, regulatory, contractual and business requirements. The guidance for the control expects a retention schedule.
- 8.10 Information deletion. Information held in systems, devices or other storage media must be deleted when no longer required. You cannot show that without knowing when “no longer required” is.
- 5.31 Legal, statutory, regulatory and contractual requirements. You must identify and document the requirements that apply to you, and retention periods are one of the commonest.
- 5.34 Privacy and protection of PII. Which, for a UK business, means UK GDPR and the Data Protection Act 2018, and therefore storage limitation.
An auditor checking these will ask for the retention schedule, ask how deletion actually happens, and pick a couple of data types to see whether the schedule is followed.
What UK law adds
The policy has to sit on top of the legal minimums. The ones that affect almost every UK business:
| Requirement | What it says | Typical effect |
|---|---|---|
| UK GDPR, Article 5(1)(e) | Personal data kept no longer than necessary for the purpose | Every personal data type needs a justified period, and a review |
| Companies Act 2006 | Accounting records kept for 3 years (private company) or 6 years (public) | Accounting records retained at least 3 years |
| HMRC rules for companies | Records supporting the company tax return kept 6 years from the end of the accounting period | Financial records in practice kept 6 years, often 7 to be safe |
| HMRC PAYE | Payroll records 3 years from the end of the tax year | Payroll data 3 years minimum |
| Limitation Act 1980 | 6 years to bring most contract claims | Contracts and related records commonly kept 6 years after they end |
| Employment practice | Various; ICO guidance is “no longer than necessary” | Most businesses keep personnel files 6 years after leaving, recruitment records for unsuccessful candidates 6 to 12 months |
These are the common cases, not legal advice. If you are regulated (financial services, healthcare, legal) your regulator will have its own periods and they take precedence. The policy should say so explicitly.
What goes in the policy
- Purpose and scope. All data the business processes, in every format, and everyone who handles it including contractors and suppliers.
- The legal and regulatory basis. A short list of the requirements that drive your periods, like the table above but specific to you.
- Principles. Keep only what is necessary; retention periods depend on data type and purpose; legal obligations override everything else; review regularly.
- The retention schedule. The table of data types with their period, the trigger that starts the clock, and the owner. This is the heart of the document.
- Backups and archives. How the periods apply to copies, and what you do about the fact that backups cannot delete single records.
- Deletion. How data is actually deleted or destroyed at the end of its period, and who confirms it.
- Exceptions. How a longer period is requested, approved and reviewed, for legal holds and the like.
- Responsibilities and review. Who owns the policy, who owns each data type, and how often it is reviewed.
Building the retention schedule
The schedule is a table. Each row is a type of data; each has a purpose, a retention period, the event that starts the period, and an owner. Here is a starting set for a typical small services or software business.
| Data type | Purpose | Retention period | Starts from |
|---|---|---|---|
| Employee records | HR, payroll | 6 years | End of employment |
| Recruitment records (unsuccessful) | Hiring | 6 months | Decision date |
| Customer contact data | Relationship management, marketing | Duration of relationship, then 2 years | Last contact or contract end |
| Customer contract and project records | Delivery, legal claims | 6 years | Contract end |
| Financial and accounting records | Accounting, tax | 6 years | End of financial year |
| Supplier contracts and records | Procurement | 6 years | Contract end |
| Business communication | 2 years, unless filed as a record | Date sent or received | |
| System and security logs | Security monitoring | 12 months | Date created |
| CCTV | Physical security | 30 days | Date recorded |
| Website analytics | Marketing | 26 months | Date collected |
The exact numbers are yours to set; what the auditor checks is that each one has a reason behind it and that you can show it being applied. Resist the temptation to set everything to “7 years”. That is not a retention policy, it is a storage policy, and it fails the GDPR test for most personal data.
The backup problem
The question I am asked most often about data retention is what to do about backups. A backup is a snapshot of everything; it cannot delete one customer’s records when their period expires. ISO 27001 and the ICO are both pragmatic about this, and the standard approach is:
- Backups exist for recovery, not for long-term storage. Say so in the policy.
- Give the backups themselves a retention period (30, 60 or 90 days is typical) after which they are overwritten or deleted.
- When data is deleted from live systems at the end of its period, it is treated as deleted; it disappears from backups when those backups cycle out.
- If you ever restore from a backup, re-apply any deletions made since it was taken.
Write that down, and the auditor has what they need. Our backup policy guide covers the rest of control 8.13.
Deletion that can be evidenced
Control 8.10 is about deletion actually happening, not just being scheduled. In practice:
- Build the schedule into the systems that can enforce it: mailbox retention rules in Microsoft 365 or Google Workspace, CRM record ageing, log rotation.
- For everything else, a periodic review (quarterly or annual, per the schedule) where data owners confirm what has been deleted. Keep a one-line record of each review.
- Paper and media are destroyed, not binned; keep the certificate if a disposal company does it.
- Leavers’ mailboxes and accounts are a common gap: decide a period (90 days is typical) and apply it.
Mistakes I see most at audit
- A policy with no schedule. The document talks about principles and never says how long anything is kept.
- A schedule nobody applies. Periods are written down, but nothing is ever deleted and nobody can show a review.
- Everything kept forever. Usually because deleting feels risky and keeping feels free. It is not free: the data is in scope of every breach and every subject access request.
- Backups ignored. The policy covers live data and is silent on the copies.
- Copied from someone else. Retention tables that reference another organisation’s systems, regulators or products. It happens more than you would think, and the auditor notices.
Where to go next
Data retention sits alongside the acceptable use policy (what people may do with data) and the backup policy (what happens to the copies). For the controls behind it, see the Annex A guide and the full controls list; the other policy guides are on the ISO 27001 policies hub. If you are building the ISMS and want help with the policy set, our ISO 27001 consultancy service does it with you.
Frequently asked questions
Does ISO 27001 require a data retention policy?
Not by name, but controls 5.33 (protection of records), 8.10 (information deletion), 5.31 (legal and contractual requirements) and 5.34 (privacy) between them require you to know how long each type of information is kept, to delete it when no longer needed, and to be able to show both. A data retention policy with a schedule is the normal way to meet them.
How long should a UK business keep data?
It depends on the type. Common periods are 6 years for financial records (HMRC) and for contracts and employee records (Limitation Act), 3 years minimum for PAYE records, and for personal data under UK GDPR only as long as the purpose requires, which you have to justify. Regulated sectors have their own rules which take precedence.
What is a data retention schedule?
The table at the heart of the policy: each type of data, the purpose it is held for, how long it is kept, when the period starts, and who owns it. Auditors check the schedule exists, that each period has a reason, and that it is actually applied.
How do backups fit into a data retention policy?
Backups cannot delete individual records, so the policy gives the backups themselves a retention period (typically 30 to 90 days), states that they exist for recovery rather than long-term storage, and treats data deleted from live systems as deleted once the backups cycle out. If a backup is restored, deletions made since are re-applied.
Can I just keep everything for 7 years?
Not for personal data. UK GDPR requires personal data to be kept no longer than necessary for its purpose, so a blanket period with no justification fails the storage limitation principle. Non-personal business records can have longer, simpler periods.
ISO 27001 Online Course + Full Toolkit
Stop guessing. Follow a proven step-by-step process.
“Highly recommended for anyone looking to understand ISO 27001, whether attempting it on your own or even using a consultant.“
Verified customer review
£285
Instant access
✓ Full toolkit included ✓ Learn as you build ✓ 12-month access ✓ 6 hours of video ✓ Call + email support
Author Background
This article was written by Alan Parker, an ISO 27001 consultant and founder of Iseo Blue Limited. He helps UK SMEs achieve certification in 90 days or less, often without a dedicated security team or a large budget.
With over 30 years in IT governance and information security, Alan works with software companies, IT service providers, managed service providers, and professional services firms across the UK, Europe, and internationally.
Qualifications: Certified ISO/IEC 27001:2022 Lead Auditor,
ITIL v3 Expert, ITIL v4 Bridge, PRINCE2 Practitioner. Named IT Project Expert of the Year (2024, UK). Alan writes in plain English for busy teams who need to get things done.
Connect on LinkedIn or Bluesky, or explore his free ISO 27001 tools and templates at iseoblue.com. B.Sc (Hons) Information Systems, CISMP certified.
