Keep only as long as needed

What it’s for

Your RoPA already notes how long you keep each kind of data. The retention schedule turns that into calculated deletion dates, flags what is due or overdue, and records each erasure, including at your vendors.

What you fill in

1. 1

   Retention schedule workbook

   Three tabs: Instructions, Schedule and Dashboard.

2. 2

   The law behind it

   The Instructions tab sets out the rules: erase when consent is withdrawn or the purpose is no longer served, the fixed periods the Rules set for some large platforms, and at least a year for personal data and logs.

3. 3

   Schedule tab

   One row per data category and purpose, brought over from your data record. Deletion dates are calculated for you, and you record each erasure, including at your vendors.

4. 4

   Dashboard tab

   Shows what is overdue, what is coming due, the pre-erasure notices to send and the erasures completed.

From the video

Two frames from the walkthrough. The worked example is a fictional online store.

Basis Act s.8(7)(a); Rule 8(1), Third Schedule; Rule 8(2); Rule 8(3); Act s.8(7)(b). How we arrived here