# Standards and Regulatory References — Data Retention Schedule

## Primary Legislation

### GDPR (Regulation (EU) 2016/679)
- **Article 5(1)(e)** — Storage limitation principle: personal data kept no longer than necessary
- **Article 13(2)(a)** — Transparency: inform data subjects of retention period or criteria
- **Article 14(2)(a)** — Transparency for data not obtained from the data subject
- **Article 30(1)(f)** — Records of processing: envisaged time limits for erasure
- **Recital 39** — Elaboration on storage limitation; requirement for time limits or periodic review

### UK Data Protection Act 2018
- **Section 39** — First data protection principle (lawfulness, fairness, transparency)
- **Section 40** — Second data protection principle (purpose limitation)

## Statutory Retention Periods (UK)

### Tax and Financial
- **Taxes Management Act 1970 s.34** — 6 years for corporation tax records
- **Income Tax (PAYE) Regulations 2003** — 6 years for payroll records from end of tax year
- **VAT Regulations 1995 reg.31** — 6 years for VAT records from end of VAT period
- **Companies Act 2006 s.386-388** — 6 years for company accounting records

### Employment
- **Employment Rights Act 1996** — Basis for employment records retention
- **Working Time Regulations 1998 reg.9** — 2 years for working time records
- **Equality Act 2010 s.123** — 6 months limitation for discrimination claims (informs minimum retention for recruitment records)
- **COSHH Regulations 2002** — 40 years for health surveillance records involving hazardous substances
- **Ionising Radiations Regulations 2017** — 50 years or until age 75 for radiation dose records

### Financial Services
- **Money Laundering Regulations 2017 reg.40** — 5 years for CDD and transaction records
- **MiFID II Article 16(6)-(7)** — 5 years (extendable to 7) for investment firm records

### General
- **Limitation Act 1980** — s.5: 6 years for contract claims; s.11: 3 years for personal injury; s.8: 12 years for deeds

## Regulatory Guidance

### ICO (UK Information Commissioner's Office)
- **ICO Retention and Disposal Policy Guidance** — Framework for determining and documenting retention periods
- **ICO Employment Practices Code** — Guidance on retention of employee and recruitment data
- **ICO CCTV Code of Practice** — 30 days recommended retention for standard CCTV footage

### EDPB (European Data Protection Board)
- **Guidelines 4/2019 on Article 25 Data Protection by Design and by Default** (adopted 20 October 2020) — Requires proactive determination of retention periods as a by-design measure

## Technical Standards
- **ISO/IEC 27701:2019** — Privacy Information Management; Section 7.4.5 on retention and deletion
- **NIST Privacy Framework 1.0** — CT.DM-P (Data Minimization) function includes retention management