Retention schedule

Charities tend to keep everything forever. That is a data protection problem, a storage problem, and a subject access problem all at once.

UK GDPR requires personal data to be kept no longer than necessary for the purpose, and the retention schedule is how you demonstrate that you have thought about it. Different records have different periods — some set by statute, some by risk.

Some periods are fixed: a charitable company must keep minutes for at least ten years (Companies Act 2006, s.248). Others are a judgement. See setting your retention schedule.