How Long Should You Keep Personal Data?

A common business practice is "keep everything just in case." That creates privacy and security risk.

One of the fundamental data-protection principles is that personal information should not be retained longer than necessary for the purpose for which it is processed, subject to applicable legal requirements.

What is a retention schedule?

A retention schedule documents:

• What information do we have?
• Why do we keep it?
• How long do we keep it?
• What starts the retention period?
• Is another law relevant?
• What happens when the period ends?

Example

Instead of "Employee files, keep indefinitely," a proper record might state:

• Record: Job applications from unsuccessful candidates
• Purpose: Recruitment
• Retention: the organisation determines an appropriate period
• Trigger: Completion of recruitment exercise
• Disposal: Secure deletion or shredding

Retention periods should not be invented

Jamaica Privacy Hub should never automatically claim that every category must be retained for a particular number of years. Different legislation, contractual requirements, limitation periods and legitimate business needs may affect retention. The platform helps the business determine and document the appropriate rule.

Disposal matters too

At the end of retention, determine whether information should be:

• securely deleted;
• physically destroyed;
• anonymised; or
• otherwise disposed of appropriately.

Simply placing files in a normal computer recycle bin may not constitute appropriate secure disposal.