Is the data stored No action necessary Update storage protocol in securely? line with Data Protection policy Does the original reason Continue to use Delete or remove data for having the data still apply? Is the data being used for Continue to use Either delete/remove or its original intention? record lawful basis for use and get consent if necessary Is there a statutory Keep the data at until Delete or remove the data requirement to keep the the statutory minimum no unless we have reason to data? longer applies keep the data under other criteria. Is the data accurate? Continue to use Ask the subject to confirm/update details Where appropriate do we Continue to use Get consent have consent to use the data. This consent could be implied by previous use and engagement by the individual Can the data be Anonymise data Continue to use anonymised Statutory Requirements Data stored by [Group name] may be retained based in statutory requirements for storing data other than data protection regulations. This might include but is not limited to: Gift Aid declarations records Details of payments made and received (e.g. in bank statements and accounting records) Trustee meeting minutes Contracts and agreements with suppliers/customers Insurance details Tax and employment records Member data When a member leaves [Group name] and all administrative tasks relating to their membership have been completed any potentially sensitive data held on them will be deleted this might include bank details or medical data – Unless consent has been given data will be removed from all email mailing lists
Is the data stored securely? No action necessary Update storage protocol in line with Data Protection policy Does the original reason for having the data still apply? Continue to use Delete or remove data Is the data being used for its original intention? Continue to use Either delete/remove or record lawful basis for use and get consent if necessary Is there a statutory requirement to keep the data? Keep the data at until the statutory minimum no longer applies Delete or remove the data unless we have reason to keep the data under other criteria. Is the data accurate? Continue to use Ask the subject to confirm/update details Where appropriate do we have consent to use the data. This consent could be implied by previous use and engagement by the individual Continue to use Get consent Can the data be anonymised Anonymise data Continue to use Statutory Requirements Data stored by [Group name] may be retained based in statutory requirements for storing data other than data protection regulations. This might include but is not limited to: Gift Aid declarations records Details of payments made and received (e.g. in bank statements and accounting records) Trustee meeting minutes Contracts and agreements with suppliers/customers Insurance details Tax and employment records Member data When a member leaves [Group name] and all administrative tasks relating to their membership have been completed any potentially sensitive data held on them will be deleted – this might include bank details or medical data Unless consent has been given data will be removed from all email mailing lists
Data%20Protection%20and%20retention%20Policy%20Template.docx