How long should we keep personal data?

England and Wales: This page sets out the position in full. Scotland: the same position — data protection is a reserved matter, so UK GDPR, the DPA 2018 and the ICO apply identically. Northern Ireland: the same position, reserved in exactly the same way.

The fine was for deleting, not keeping

Charity data retention can fail in either direction. The one ICO fine against a charity was for deleting records, not keeping them. Retention is a job for the manager and the trustees. The UK GDPR rules are the same in England and Wales, Scotland and Northern Ireland.

If you have not yet written your data protection policy, do that first. The schedule is one of the procedures it relies on.

Most advice on retention warns in one direction: you are keeping too much, for too long. That risk is real. But the ICO’s retention case against a charity points the other way.

Birthlink is a small Scottish charity that supports people affected by adoption. In 2021 it destroyed around 4,800 “Linked Records” — handwritten letters, photographs and birth certificates.

Up to a tenth of them may not be replaceable. The ICO found poor retention decisions and untrained staff behind the loss. In July 2025 it fined the charity £18,000.

This was not a cyber attack and not a marketing case. It was a records decision, made badly. Birthlink was fined for destroying records it should have kept — retention failures cut both ways.

A destruction decision is a retention decision

So treat shredding and deleting as decisions, not housekeeping. Each one needs three things:

• A reason on paper. Why this category can go, and why now.
• A trained person making the call. Not whoever is clearing the office.
• A record of what went, and when. That record is your evidence if anyone asks later.

The Birthlink failure was not a missing schedule. It was a decision taken by people who did not know what they were holding. The fix is a named person with the power to destroy records, and the training to know when not to.

This matches the wider pattern. Across the ICO’s action against charities, the common thread is a lack of basic written policy, training and governance. It is not how clever any attack was.

No regulator publishes a schedule to copy

You will look for a template from the ICO. The ICO does not publish one. That is a checked answer, not a gap in the research.

UK GDPR Articles 13 and 14 have been read for this guide. They say what your privacy notice must tell people. One item on that list reads: The retention period, or the criteria used to determine it. That is a line in the public notice.

A retention schedule is the charity’s written list of how long it keeps each category of personal data, and why. Neither the Articles nor the ICO’s guidance sets any content for a charity’s own schedule. The research checked for this and found none. So the instruction is short:

• set each period by the purpose you hold the data for
• write down the reason next to it
• take any period set by law from the rule that sets it, not from a template

What your notice says has to match what the schedule says. The step to write your privacy notice covers the notice line.

Where the statutory periods live

Some records do have periods set by law — accounting records, company records and Gift Aid records among them. Those periods are not personal-data rules. They belong to the reporting hub’s schedule, in the step to set up your record retention schedule.

How long to keep trustee minutes is covered where you establish how you take and store minutes.

Do not copy those periods into a second schedule here. Keep one document. This page owns only the personal-data periods: supporters, volunteers, beneficiaries, staff, and the rest of your data map.

The answer is one schedule with two kinds of row. Some rows say “the law sets this — see the reporting schedule”. The rest say “we set this, and here is why”.

Build the data retention schedule from the data map

Work through the categories on your data map in this order:

1. Name the category — for example, “case files for the closed befriending service”.
2. Name the purpose you hold it for, in one line.
3. Check for a period set by law. If one applies, point to the reporting schedule and stop.
4. Otherwise, set your own period and write the reason beside it.
5. Ask who might need it later. Records that matter to a person’s identity or history need a longer look, not a shorter one.
6. Name who may destroy it, and how the destruction is recorded.
7. Put the deletion routine in the diary, with a date and an owner.

The last step is the one that fails. A schedule with a review date that nobody runs is evidence against you. It shows you knew what you should do and did not do it.

Next: Can we email our supporters without explicit consent? The marketing rules are the other place where holding data and using it part company.

Common mistake: writing a schedule that only guards against keeping data too long

Almost all advice on retention warns one way. Birthlink points the other way. This small Scottish charity was fined for destroying records that could not be replaced. The causes were poor retention decisions and untrained staff. Retention failures cut both ways.

A destruction decision is a retention decision. It needs a trained person making it.

Common mistake: assuming a statutory data protection period exists for every category

Some periods set by law do exist, for accounting, company and Gift Aid records. People assume they cover personal data generally. They do not. No regulator sets the content of an internal retention schedule. That absence was checked.

Those periods belong to the reporting hub’s schedule. This step owns the personal-data periods, set by purpose, with the reason written down.

Worked example

Saltmarsh Trust closes a support service. A manager proposes shredding all the case files “to be safe”.

The retention lead stops it and opens the schedule. The case files are a category on the data map, with a period and a reason already written against them.

Some of the records are letters and photographs that former service users may later ask for. That puts them in the “who might need it later” row, and the reason says so. Nothing in the files carries a period set by law, so nothing points to the reporting schedule.

The files are held for the period the schedule sets, not shredded on instinct. The schedule also names who may approve destruction when that period ends. It also says how the destruction will be recorded.

The outcome is a retention schedule covering every category on the data map and a diarised deletion routine. A named, trained person decides on destruction.