Keeping information feels safer than deleting it. What if someone needs it later? What if a customer returns? What if there is a dispute?
Sometimes there is a good reason to keep a record. But keeping everything indefinitely is not a retention strategy.
The UK GDPR's storage-limitation principle requires personal data not to be kept longer than necessary for the purpose it was collected or used for. The ICO also expects organisations to justify retention decisions, review what they hold and erase or anonymise personal data when it is no longer needed, subject to relevant exceptions and obligations.
The useful first question isn't, 'How much data can we delete?' It's, 'Why do we still have this?'
Where old information tends to hide
Think beyond your main database. Information can remain in former employees' exports, shared drives, email attachments, old ticket systems, customer-support records, third-party tools and archives nobody has reviewed for years.
A business can have a sensible policy on paper while older copies continue to circulate elsewhere.
Four decisions to make before changing anything
1. What information is being kept, and for which purpose?
Start with categories: customer records, recruitment applications, supplier contacts, contracts or support histories. Document why each category is needed. Different purposes can justify different retention periods.
2. What rules require some information to be kept?
Legal obligations, professional requirements, recordkeeping rules and the need to establish or defend legal claims can affect retention. Do not mass-delete records or disturb legal holds merely because a file looks old. The right review includes the exceptions.
3. Who decides when the information is no longer needed?
Someone should own each category and the decision. If nobody owns the process, a retention schedule is likely to become a spreadsheet that no one follows.
4. Can deletion or anonymisation happen in practice?
Check live systems, exports, backups and providers' retention arrangements. Understand what can be removed automatically, what needs approval and how evidence of the process is recorded.
A simple starting exercise
Choose one category, for example, recruitment records. Identify where the records exist, who uses them, why they are kept, what rules apply and when the retention period should be reviewed. Then test whether the proposed process works in the systems people use.
This is more useful than writing a policy with a single number for every file.
Why this matters beyond compliance
Old information can make searching harder, create unnecessary storage or security work and increase the amount of material exposed if an incident happens. A proportionate retention approach helps teams understand what they need and what they can responsibly remove.
Evolut's advisory perspective starts with the questions of purpose, ownership and practical process. Specialist legal, privacy or technical support may be needed to design or implement specific retention controls.
Further reading: original sources
This article offers general information and is not legal or regulatory advice. Requirements depend on your organisation and circumstances.