ISO 27001 Data Retention Policy Template

The Data Retention Policy Template fully supports Data Protection Laws including GDPR, Data Protection Act 2018 and Information Security standards such as ISO/IEC 27001:2022 and ISO/IEC 27001:2013, PCI DSS and SOC 2.

The Data Retention Policy Template is in Microsoft Word format.

You get the Data Retention Policy Template immediately on successful payment.

Yes. The Data Retention Policy Template supports best practice for Data Protection and the International Standard for Information Security. It is being used successfully right now across the globe.

We estimate that on average about 1 hour.

Payments are handled entirely through Stripe. They are very secure. We do not handle, touch or get access to the payment transaction or your data.

Data Retention is keeping records for set periods of time to comply with business needs, industry guidelines, and regulations. There are any number of reasons why a business might need to retain data. Examples of data retention include: to maintain accurate financial records, to abide by local, state and federal laws, to comply with industry regulations, to ensure that information is easily accessible for eDiscovery and litigation purposes. Without a data retention policy and organisations risks breaking the law, not meeting regulation, increased costs, operational risks and information security risks. Data retention is about keeping data and information that is needed, only for as long as it is needed, an no longer. Most modern laws and regulations require and organisation to implement Data Retention.

The data retention policy is a clear statement of what you do for data retention. It is not a statement of how you do it. How you do it is covered in your data retention processes. It determines the purpose of data, what laws and regulations apply, how long it should be kept and how it should be deleted or archived. It is designed to communicate to people what is expected and it is a governance mechanism that allows enforcement for when rules are broken.

The data retention policy includes and contains:
A classification of information
Specifications on how long you keep each element of data
Data retention periods approved by the legal department or legal counsel
Expiration or retention period and how data is destroyed or archived
Who has authority to dispose of data
Roles and responsibilities
What happens if there is a breach of policy
How you manage acceptors to the policy
Versions control, document mark such as last reviewed data, document owner, document version

A data retention period is the length of time that the organisation keeps information. This includes whether or not it is storing, processing or transmitting it. How long do you keep it for. Best practice and driven by law and regulation is to keep data only for as long as is necessary. The definition of how long is necessary is decided by the business but ‘for ever’ is not an acceptable answer. It is best defined in collaboration with the legal department or legal counsel.

Data should be kept as long is necessary. The definition of as long as is necessary is defined by the organisation.

The organisation has overall sign off which means in practice the data owner decides how long the data should be kept and this is reviewed and agreed with the data protection officer, the information security officer, legal counsel and senior management.

The data owner decides how long data should be kept based on the requirements of the business, the requirements of its purpose, legal and regulatory requirements and best practice.

Yes, backups are included in the data retention policy. You need to consider the retention and destruction of backups in line with data retention requirements.

Data Retention Laws are specific to the location of the organisation. Countries, states, regions all potentially have different data retention laws. You can consider the European Law on the GDPR as a good example. You should always work with your legal counsel to identify which specific data retention laws apply to you.

No. ISO 27001 covers a specific scope which will be a subset of your organisations data and processes to be used for ISO 27001 certification. The wider business needs to also be considered and covered by Data Retention.

The Data Retention Policy provided by your data protection specialist will be the data retention policy that use as it will, if it follows best practice, include the data in scope for ISO 27001 as well as the wider data retention requirements of the organisation.

1. Data Retention MUST meets the requirements of applicable laws and regulations
2. Determine your actual business needs
3. Don’t hold onto data longer than is necessary
4. Get sign off by the data owner, legal counsel and senior management for the set retention periods
5. Ensure you have a data asset register
6. Ensure you have mapped your processes and data flows
7. Consider implementing a record of processing activity
8. Keep it as simple as possible