Annex A: Suggested Data Retention Policy Please note: Where the reason for keeping is “Legal”, the retention period is definitive. The remainder are taken from Scottish Government Records Management policies and other documents which outline best practice. Organisations may choose to keep documents for less or more time than is recommended, but are advised to weigh up the needs for retention against the risk of destruction before doing so, taking into account the rights of the data subject under the GDPR. Reason for Record Minimum retention period Comments keeping 10 years after the death of the PMR Legal Backup to archives likely patient The Human Medicines Private Prescriptions Legal 2 years Regulations 2012 (regulation 253 (5)) The Human Medicines POM Register Legal 2 years from last entry Regulations 2012 (regulation 253 (5)) Dispensing Veterinary medicines regulations 2009 (SI 2297). Must keep all POM-V and POM-VPS documents relating to the records of receipt and Legal At least 5 years transaction. Specific supply requirements for what information must be included.
Annex A: Suggested Data Retention Policy Please note: Where the reason for keeping is “Legal”, the retention period is definitive. The remainder are taken from Scottish Government Records Management policies and other documents which outline best practice. Organisations may choose to keep documents for less or more time than is recommended, but are advised to weigh up the needs for retention against the risk of destruction before doing so, taking into account the rights of the data subject under the GDPR. Record Reason for keeping Minimum retention period Comments Dispensing PMR Legal 10 years after the death of the patient Backup to archives likely Private Prescriptions Legal 2 years The Human Medicines Regulations 2012 (regulation 253 (5)) POM Register Legal 2 years from last entry The Human Medicines Regulations 2012 (regulation 253 (5)) POM-V and POM-VPS records of receipt and supply Legal At least 5 years Veterinary medicines regulations 2009 (SI 2297). Must keep all documents relating to the transaction. Specific requirements for what information must be included.
gdpr-part-3-workbook-may-2018-1.docx