GDPR Retention Policy

 GDPR Retention Policy

To ensure WHCE complies with GDPR in respect of retaining data, the tables below provide an easily readable format for staff guidance in respect of both WHCE statutory and non-statutory retention periods.

Statutory Retention Periods

The table below summarises the main legislation regulating statutory retention periods. If staff are in doubt, it is a good idea to keep records for at least 6 years, to cover the time limit for bringing any civil legal action.

Record Statutory Retention Period Statutory Authority Responsible Authority
Accident books, accident records /reports 3 years from the date of the last entry (or, if the accident involves a child/young adult, then until that person reaches the age of 21) The Reporting of Injuries, Diseases and Dangerous Occurrences Regulations. 2013 (RIDDOR) + (B1510) under Social security Law  WHCE https://www.hse.gov.uk/pubns/indg453.pdf Refer to the above link for injuries that that RIDDOR would inspect for as we keep an accident book also note over 7 day Injuries to workers. Special rules apply concerning incidents involving hazardous substances.
Income tax/ Inland revenue, NI returns, HMRC records  6 years after the end of the financial year to which they relate HMRC requirement The Income Tax (Employments) Regulations 1993 (SI 1993/744) The Income Tax (Employments (Amendment No. 6) Regulations 1996 (SI 1996/2631) WHCE out sourced payroll to Paula Kench AICB our Bookkeeper at Carole A Dowland Bookkeeping Services Ltd
Medical records as specified by the Control of Substances Hazardous to Health Regulations (COSHH) 40 years from the date of the last entry The Control of Substances Hazardous to Health Regulations 1999 and 2002 (COSHH) (SIS 1999/437 and 2002/2677) Currently this is BCP Councils responsibility for the building When it involves WHCE staff / volunteers it is WHCE responsibility e.g. the Cleaner needs to inform the Charity Manager. AF Read this! https://www.materials.ox.ac.uk/files/COSHHRegulationspdf
Records relating to children & young adults gathered at events e.g. parental permission membership, names address emergency contact etc. Until the child/young adult reaches the age of 21 Section 123 of the Data Protection Act 2018                                Article 5 of the GDPR  Article 3 of the United Nations Convention on the Rights of the Child. BCP Council Youth Service responsibility they use the building Also WHCE  see https://ico.org.uk/media/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/children-and-the-gdpr-1-0.pdf DP Impact Assessment to be completed prior to service delivery
Pension & Retirement Benefits Schemes – + notifiable events, e.g. incapacity Pension 6 years from the end of the scheme year in which the event took place Incapacity 12 years from the ending of any benefit payable. The Retirement Benefits Schemes (Information Powers) Regulations 1995 (SI 1995/3103) WHCE out sourced payroll to Paula Kench AICB Bookkeeper at Carole A Dowland Bookkeeping Services Ltd Note Nest is the pension provider
Statutory Maternity Pay records, calculations, certificates (Mat B1s) or other medical evidence Parental leave            SSP 3 years after the end of the tax year we paid SSP                          Legally employers must keep any SSP or SMP info for a minimum of 3 years                              Parental Leave  5 years from Birth or adoption or 18 years if child receives disability allowance   The Statutory Maternity Pay (General) Regulations 1986 (SI 1986/1960) as amended WHCE out sourced payroll to Paula Kench AICB our Bookkeeper at Carole A Dowland Bookkeeping Services Ltd But WHCE would have MATB1’s & sick certs etc
Wage/salary records (also overtime, bonuses, expenses) 6 years HM Revenue and Customs (HMRC)Taxes and constructive dismissal claims WHCE out sourced payroll to Paula Kench AICB our Bookkeeper at Carole A Dowland Bookkeeping Services Ltd, through Jackie & Jane Trustees
Timesheets for working time reg’s min 3 years as HMRC may want to check they are paying the correct tax and audits recommended 6 years HM Revenue and Customs (HMRC)Taxes and constructive dismissal claims Retained by WHCE
National minimum wage records 3 years after the end of the pay reference period following the one that the records cover National Minimum Wage Act 1998 WHCE out sourced payroll to Paula Kench AICB our Bookkeeper at Carole A Dowland Bookkeeping Services Ltd
Staff Data – written statement of particulars &  Contract of employment, salaries,                                                                                  Written statement of particulars Contact of employment        Salaries 6 years   Demonstrates adherence to The Working Time Regulations 1998 (SI 1998/1833) WHCE

Non-statutory – Retention Periods

For many types of personal data, there are no definitive retention period: it is up to the charity to decide how long to keep these records.

WHCE has adopted an approach of considering what would be a necessary retention period for them, depending on the type of record and based on the time limits for potential tribunal or civil claims which would be required to protect the organisations reputation.

Where WHCE has decided on a retention period of 6 years, this is based on the 6-year time limit within which legal proceedings must be commenced as laid down under the Limitation Act 1980. Thus, where documents may be relevant to a contractual claim, it is recommended that these be retained for at least the corresponding 6-year limitation period.

Record Recommended Retention Period Responsibility
Application forms and interview notes (for unsuccessful candidates) Because of the time limits in the various discrimination Acts, min retention for records relating to advertising of vacancies & job applications should be at least 6 months.  However 1 Year is advisable as the time limits for bringing claims can be extended.       WHCE
Staff Data at on boarding :- names, NI number, addresses, email ,phone number , mobile number, eligibility to work in the UK, education and training , Professional Membership, Employment History, References , Disability, Driving , Criminal convictions,                                                                                                                                                                                                                     ON EQUALITY FORM gender, ethnicity, marital status, sexual orientation, age, disability, religion, pregnancy and maternity, Refugee- Asylum seeker, Language, Payroll require for 6 years after employment ceases   WHCE & Payroll
Staff Data – Bank account details , NI number, Income tax/ Inland revenue, NI returns, HMRC 6 years after employment ceases   WHCE & Payroll
Contract of employment,   6 years after employment ceases   WHCE
Volunteers – names addresses phone number, mobile number, email addresses I think we should contact them every year to confirm if they wish to remain or be removed WHCE
S&S / performance, Appraisals,  RTW & training,   Records 6 years. To cover breach of contract which can be claimed within 6 years WHCE In House Policy requirements
Disciplinary , grievances, capabilities , warning ,   Disciplinary , capabilities stage one 6 months  final warning  12 months grievances, 12 months WHCE
Staff Timesheets expenses data, & working time reg’s 3 years as HMRC may want to check they are paying the correct tax & audits The Working Time Regulations 1998 (SI 1998/1833)   WHCE
Personnel files and training records 6 years after employment ceases     WHCE
Disciplinary  & Grievances    stage one 6 months  final warning  12 months WHCE  
Appraisals S&S 6 years To cover breach of contract which can be claimed within 6 years WHCE  
Inward references     Inward references retain on BreatheHR our HRIS 5 years after employment ceases                        WHCE      
Outward references retain on BreatheHR our HRIS for 5 year in cases of discriminatory claim them confidentially shred   Outward references retain on BreatheHR our HRIS for 5 years (1 year in cases of discriminatory claim then a following 4 to enable standardised reference provision) after a total of 5 years after employment ceases we confidentially shred.     WHCE
Redundancy details, calculations of payments, refunds, 6 years from the date of redundancy WHCE
Team meetings 6 Years for planning purposes   WHCE
Statutory Sick Pay records, calculations, certificates, self-certificates To protect the org from a disability discrimination claim or breach of an employment contract it is recommended to keep for 6 years after the employment ceases.   WHCE out sourced payroll to Paula Kench AICB our Bookkeeper at Carole A Dowland Bookkeeping Services Ltd WHCE retain hard copy sick certs etc.
Working Time records Time Sheets & expenses 3 years as HMRC may want to check they are paying the correct tax & audits recommended 6 years WHCE
Trustees’ minute’s Permanently   Trustees
Community -Customers – names addresses phone number, mobile number, email addresses Facebook, Twitter, Instagram annual review opt to remain in + see https://ico.org.uk/media/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/children-and-the-gdpr-1-0.pdf   DP Impact Assessment to be completed prior to service delivery WHCE
Stakeholder organisations staff (e.g. BCP council) – names addresses phone number, mobile number, email addresses, Removed when we terminate working relationships WHCE
Suppliers (goods & services) e.g. stores supplies and Bookkeeping – names addresses phone number, mobile number, email addresses Removed when we terminate working relationships WHCE
Staff & Volunteers  criminal offences  & DBS – (separate category requiring additional lawful bases to process); RA duration of employ & 6 yrs following end of employment. DBS Number retained  in locked filing cabinet for duration of employment & 6 yrs following end of employment  

Data on expiry date must be removed via deletion from any electronic storage / retention systems, then deleted from any deleted folders and removed from IT backup systems.

Likewise and hard copies must be removed and confidentially shredded.