Guest user Created: Feb 01, 2018 Last commented: Feb 01, 2018

Data retention policy

The template for data retention policy and schedule seems to cover all types of documents and information in the company. Is that necessary according to GDPR, or is it only necessary to have a policy and retention schedule for documents containing personal data? Managing all documents seems to be a significantly larger task than only those with personal data?

0 0

Assign topic to the user

Select user

Expert

Andrei Hanganu Feb 01, 2018

Answer:

The EU GDPR states that personal data should not be kept for longer than necessary (https://advisera.com/gdpr/principles-relating-to-processing-of-personal-data/) thus all records of personal data need to be deleted at some point when no longer needed for a specific activity.

The documents listed in the Data Retention Policy are one of the most common records where personal data can be found, you can delete or add records based on your own business activity. Remember that the retention refers only to personal data thus records that do not contain personal data are not in scope of the policy or the GDPR.

Quote

0 0

Comment as guest or Sign in

HTML tags are not allowed

Name *

Email *

I accept the Privacy and Terms

Notify me when someone replies

Feb 01, 2018

Expert Advice Community