Data retention policy for UK businesses: what it is, why you need one and what to include

Do you operate a business in the UK with a website that has a contact form collecting personal information, such as people's names, email addresses and phone numbers? If so, you will likely need a data retention policy. This page explains what that policy is, why it matters, and what needs to go in it.

What is a data retention policy?

A data retention policy is a legal document, usually hosted on a business's website, that details to website users what kind of data the business collects, for how long it stores that data, and what that data is used for, amongst other things.

It is written for the people whose data you hold, not for your internal team. The point is transparency: anyone who gives you their details through your website should be able to find out what you are going to do with them and how long you will keep them.

Why a data retention policy matters (ICO)

If you do not have a compliant data retention policy, there are two main risks you are facing.

• A claim from the data subject. The data subject is the person from whom you are collecting data. If you are not handling their data in a compliant way, they may bring a claim against you.
• A fine from the regulator. You might be fined by the UK Information Commissioner's Office, the ICO, and those fines can be hefty.

Neither risk depends on the size of your business. A small company with a simple contact form is collecting personal data in exactly the same way as a large one, and in my experience it is small businesses that most often have no policy at all, simply because nobody has thought about it.

What to include in a data retention policy

There is quite a lot of information that needs to be included in a data retention policy, and a proper one will be tailored to how your business actually handles data. Some of the basics are:

• The reason for collecting the data. Why you are asking for it in the first place, for example to respond to an enquiry.
• What kind of data you are collecting. Names, email addresses, phone numbers, and anything else your forms or systems capture.
• How long you are storing it. The retention period, which is the part most people forget to decide, let alone write down.
• Who you are sharing it with. Any third parties that receive the data, such as the providers of the tools you use to store or process it.
• The basis for collecting the data. The legal grounds you rely on for collecting and holding it.

If you cannot answer those five questions for the data you currently hold, that is the place to start, because you cannot write an accurate policy until you know what you actually do.

Next steps

Audit what personal data your website and your business collect, where it goes and how long you keep it. Then put a data retention policy on your website that covers the reason for collection, the types of data, the retention period, the parties you share with and the basis for collection. If you are unsure whether your current policy is compliant, have a commercial solicitor review it before the regulator or a data subject does.