GDPR Retention Policy
To ensure WHCE complies with GDPR in respect of retaining data, the tables below provide an easily readable format for staff guidance in respect of both WHCE statutory and non-statutory retention periods.
Statutory Retention Periods
The table below summarises the main legislation regulating statutory retention periods. If staff are in doubt, it is a good idea to keep records for at least 6 years, to cover the time limit for bringing any civil legal action.
| Record | Statutory Retention Period | Statutory Authority | Responsible Authority |
| Accident books, accident records /reports | 3 years from the date of the last entry (or, if the accident involves a child/young adult, then until that person reaches the age of 21) | The Reporting of Injuries, Diseases and Dangerous Occurrences Regulations. 2013 (RIDDOR) + (B1510) under Social security Law | WHCE https://www.hse.gov.uk/pubns/indg453.pdf Refer to the above link for injuries that that RIDDOR would inspect for as we keep an accident book also note over 7 day Injuries to workers. Special rules apply concerning incidents involving hazardous substances. |
| Income tax/ Inland revenue, NI returns, HMRC records | 6 years after the end of the financial year to which they relate | HMRC requirement The Income Tax (Employments) Regulations 1993 (SI 1993/744) The Income Tax (Employments (Amendment No. 6) Regulations 1996 (SI 1996/2631) | WHCE out sourced payroll to Paula Kench AICB our Bookkeeper at Carole A Dowland Bookkeeping Services Ltd |
| Medical records as specified by the Control of Substances Hazardous to Health Regulations (COSHH) | 40 years from the date of the last entry | The Control of Substances Hazardous to Health Regulations 1999 and 2002 (COSHH) (SIS 1999/437 and 2002/2677) | Currently this is BCP Councils responsibility for the building When it involves WHCE staff / volunteers it is WHCE responsibility e.g. the Cleaner needs to inform the Charity Manager. AF Read this! https://www.materials.ox.ac.uk/files/COSHHRegulationspdf |
| Records relating to children & young adults gathered at events e.g. parental permission membership, names address emergency contact etc. | Until the child/young adult reaches the age of 21 | Section 123 of the Data Protection Act 2018 Article 5 of the GDPR Article 3 of the United Nations Convention on the Rights of the Child. | BCP Council Youth Service responsibility they use the building Also WHCE see https://ico.org.uk/media/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/children-and-the-gdpr-1-0.pdf DP Impact Assessment to be completed prior to service delivery |
| Pension & Retirement Benefits Schemes – + notifiable events, e.g. incapacity | Pension 6 years from the end of the scheme year in which the event took place Incapacity 12 years from the ending of any benefit payable. | The Retirement Benefits Schemes (Information Powers) Regulations 1995 (SI 1995/3103) | WHCE out sourced payroll to Paula Kench AICB Bookkeeper at Carole A Dowland Bookkeeping Services Ltd Note Nest is the pension provider |
| Statutory Maternity Pay records, calculations, certificates (Mat B1s) or other medical evidence Parental leave | SSP 3 years after the end of the tax year we paid SSP Legally employers must keep any SSP or SMP info for a minimum of 3 years Parental Leave 5 years from Birth or adoption or 18 years if child receives disability allowance | The Statutory Maternity Pay (General) Regulations 1986 (SI 1986/1960) as amended | WHCE out sourced payroll to Paula Kench AICB our Bookkeeper at Carole A Dowland Bookkeeping Services Ltd But WHCE would have MATB1’s & sick certs etc |
| Wage/salary records (also overtime, bonuses, expenses) | 6 years | HM Revenue and Customs (HMRC)Taxes and constructive dismissal claims | WHCE out sourced payroll to Paula Kench AICB our Bookkeeper at Carole A Dowland Bookkeeping Services Ltd, through Jackie & Jane Trustees |
| Timesheets for working time reg’s | min 3 years as HMRC may want to check they are paying the correct tax and audits recommended 6 years | HM Revenue and Customs (HMRC)Taxes and constructive dismissal claims | Retained by WHCE |
| National minimum wage records | 3 years after the end of the pay reference period following the one that the records cover | National Minimum Wage Act 1998 | WHCE out sourced payroll to Paula Kench AICB our Bookkeeper at Carole A Dowland Bookkeeping Services Ltd |
| Staff Data – written statement of particulars & Contract of employment, salaries, | Written statement of particulars & Contact of employment Salaries 6 years | Demonstrates adherence to The Working Time Regulations 1998 (SI 1998/1833) | WHCE |
Non-statutory – Retention Periods
For many types of personal data, there are no definitive retention period: it is up to the charity to decide how long to keep these records.
WHCE has adopted an approach of considering what would be a necessary retention period for them, depending on the type of record and based on the time limits for potential tribunal or civil claims which would be required to protect the organisations reputation.
Where WHCE has decided on a retention period of 6 years, this is based on the 6-year time limit within which legal proceedings must be commenced as laid down under the Limitation Act 1980. Thus, where documents may be relevant to a contractual claim, it is recommended that these be retained for at least the corresponding 6-year limitation period.
| Record | Recommended Retention Period | Responsibility |
| Application forms and interview notes (for unsuccessful candidates) | Because of the time limits in the various discrimination Acts, min retention for records relating to advertising of vacancies & job applications should be at least 6 months. However 1 Year is advisable as the time limits for bringing claims can be extended. | WHCE |
| Staff Data at on boarding :- names, NI number, addresses, email ,phone number , mobile number, eligibility to work in the UK, education and training , Professional Membership, Employment History, References , Disability, Driving , Criminal convictions, ON EQUALITY FORM gender, ethnicity, marital status, sexual orientation, age, disability, religion, pregnancy and maternity, Refugee- Asylum seeker, Language, | Payroll require for 6 years after employment ceases | WHCE & Payroll |
| Staff Data – Bank account details , NI number, Income tax/ Inland revenue, NI returns, HMRC | 6 years after employment ceases | WHCE & Payroll |
| Contract of employment, | 6 years after employment ceases | WHCE |
| Volunteers – names addresses phone number, mobile number, email addresses | I think we should contact them every year to confirm if they wish to remain or be removed | WHCE |
| S&S / performance, Appraisals, RTW & training, | Records 6 years. To cover breach of contract which can be claimed within 6 years | WHCE In House Policy requirements |
| Disciplinary , grievances, capabilities , warning , | Disciplinary , capabilities stage one 6 months final warning 12 months grievances, 12 months | WHCE |
| Staff Timesheets expenses data, & working time reg’s | 3 years as HMRC may want to check they are paying the correct tax & audits The Working Time Regulations 1998 (SI 1998/1833) | WHCE |
| Personnel files and training records | 6 years after employment ceases | WHCE |
| Disciplinary & Grievances | stage one 6 months final warning 12 months | WHCE |
| Appraisals S&S | 6 years To cover breach of contract which can be claimed within 6 years | WHCE |
| Inward references | Inward references retain on BreatheHR our HRIS 5 years after employment ceases | WHCE |
| Outward references retain on BreatheHR our HRIS for 5 year in cases of discriminatory claim them confidentially shred | Outward references retain on BreatheHR our HRIS for 5 years (1 year in cases of discriminatory claim then a following 4 to enable standardised reference provision) after a total of 5 years after employment ceases we confidentially shred. | WHCE |
| Redundancy details, calculations of payments, refunds, | 6 years from the date of redundancy | WHCE |
| Team meetings | 6 Years for planning purposes | WHCE |
| Statutory Sick Pay records, calculations, certificates, self-certificates | To protect the org from a disability discrimination claim or breach of an employment contract it is recommended to keep for 6 years after the employment ceases. | WHCE out sourced payroll to Paula Kench AICB our Bookkeeper at Carole A Dowland Bookkeeping Services Ltd WHCE retain hard copy sick certs etc. |
| Working Time records Time Sheets & expenses | 3 years as HMRC may want to check they are paying the correct tax & audits recommended 6 years | WHCE |
| Trustees’ minute’s | Permanently | Trustees |
| Community -Customers – names addresses phone number, mobile number, email addresses Facebook, Twitter, Instagram | annual review opt to remain in + see https://ico.org.uk/media/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/children-and-the-gdpr-1-0.pdf DP Impact Assessment to be completed prior to service delivery | WHCE |
| Stakeholder organisations staff (e.g. BCP council) – names addresses phone number, mobile number, email addresses, | Removed when we terminate working relationships | WHCE |
| Suppliers (goods & services) e.g. stores supplies and Bookkeeping – names addresses phone number, mobile number, email addresses | Removed when we terminate working relationships | WHCE |
| Staff & Volunteers criminal offences & DBS – (separate category requiring additional lawful bases to process); | RA duration of employ & 6 yrs following end of employment. DBS Number retained in locked filing cabinet for duration of employment & 6 yrs following end of employment |
Data on expiry date must be removed via deletion from any electronic storage / retention systems, then deleted from any deleted folders and removed from IT backup systems.
Likewise and hard copies must be removed and confidentially shredded.