ECSH11000 | Data Protection Act 2018/General Data Protection Regulation: data retention and disposal

Personal data has a retention period, being the maximum length of time that the data can be held.

Section 39 of the Data Protection Act 2018 (DPA 2018) specifies that personal data shall be kept for no longer than is necessary for the purposes for which the personal data are processed.

HMRC has a retention policy for personal data, setting out how long personal data can be held by each directorate.

Economic Crime-Supervision (EC-S), as part of Customer Compliance Group (CCG), applies the following retention policy.