Retention and Disposal policy

May 2026

Introduction

The Parish Council accumulates a vast amount of information and data during the course of its everyday activities. This includes data generated internally in addition to information obtained from individuals, councillors, contractors, government bodies and external organisations. This information is recorded in various types of documents and may be held in paper, electronic or cloud based formats.

Records created and maintained by the Parish Council are an important corporate asset and, as such, appropriate measures must be undertaken to safeguard this information. Properly managed records provide authentic and reliable evidence of the Council's transactions and are necessary to demonstrate accountability, transparency and compliance with statutory obligations.

Documents may be retained in either paper or electronic format. For the purpose of this policy, the terms document and record include paper records, electronic records, emails, scanned documents, databases, digital images, audio recordings, text messages, messaging applications used for Council business, cloud-based records and any other recorded information created or received by the Council.

It is imperative that documents are retained for an appropriate period of time. If documents are destroyed prematurely, the Council and individual officers concerned may fail to comply with statutory obligations, prejudice legal proceedings, hinder audits or investigations, cause operational difficulties, reputational damage or impair the Council's ability to defend legal claims.

Conversely, the Council should not retain documents longer than is necessary. Timely disposal should be undertaken to ensure compliance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, so that personal information is not retained longer than necessary. This also supports good records management and the efficient use of storage space..

Scope and Objectives of the Policy

The aim of this document is to provide a working framework to determine which documents are:

Retained - and for how long; or
Disposed of - and, if so, by what method

There are some records that do not need to be kept at all or that are routinely destroyed in the course of business. This usually applies to information that is duplicated, unimportant or only of a short-term value. Examples include:

'With compliments' slips.
Catalogues and trade journals.
Non-acceptance of invitations.
Routine administrative emails once actioned
Requests for information such as maps, plans or advertising material.
Out of date distribution lists.
Duplicate copies of documents where an official record is held elsewhere.

Duplicated and superseded material such as stationery, manuals, drafts, forms, address books, reference copies of annual reports and previous versions of documents may be destroyed once they are no longer required for operational purposes.

Records should not be destroyed where they may be required:

to meet statutory or regulatory requirements;
for audit purposes;
in relation to complaints or investigations;
as evidence in legal proceedings;
for insurance purposes;
in response to Freedom of Information or Environmental Information requests;
in connection with a Subject Access Request; or
because they have historical or archival value.

Any disposal of records containing personal data must be undertaken securely and in accordance with the UK GDPR and the Data Protection Act 2018.

Roles and Responsibilities for Document Retention and Disposal

The Council is responsible for determining whether records should be retained or disposed of and shall undertake a review of documentation at least annually to ensure that records no longer required are disposed of securely and in accordance with the UK GDPR, the Data Protection Act 2018 and this policy.

The Council shall ensure that all councillors, employees and any contractors handling Council records are aware of the Council's retention and disposal arrangements and their responsibilities under this policy.

The Clerk shall be responsible for implementing this policy, maintaining the Council's records management arrangements, overseeing the secure disposal of records and ensuring that any legal hold is applied where records are required for litigation, complaints, investigations, audits or other statutory purposes.

Document Retention Protocol

The Council should have in place an adequate system for documenting the activities of its services. This system should take into account the legislative and regulatory environment in which it operates, including the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, the Freedom of Information Act 2000 and other relevant legislation.

Records of each activity should be complete and accurate enough to allow employees, councillors and their successors to undertake appropriate actions in the context of their responsibilities to:

Facilitate an audit, inspection or examination of the Council's business by anyone so authorised.
Protect the legal and other rights of the Council, its residents, employees, contractors and any other persons affected by its actions.
Verify where appropriate the lawful basis for processing personal data and any consent obtained.
Demonstrate compliance with statutory obligations and the Council's accountability requirements.
Provide authenticity and integrity of records so that the evidence derived from them is credible and authoritative.

To facilitate this the following principles should be adopted:

Records created and maintained should be organised within a record management system that enables efficient retrieval of information and compliance with the UK GDPR, the Freedom of Information Act 2000 and the Environmental Information Regulations 2004.
Appropriate technical and organisational measures shall be in place to protect records from accidental loss, unauthorised access, alteration or destruction.
Documents that are no longer required for operational purposes but require continued retention should be securely archived, either electronically or in paper form, as appropriate.
Electronic records, including emails, cloud based documents, digital images and records held within approved software systems, shall be managed in accordance with this policy.
Appropriate back up arrangements shall be maintained for electronic records in accordance with the Council's ICT and cyber security procedures.

The retention schedules in Appendix A – List of Documents for Retention or Disposal provide guidance on the recommended minimum retention periods for specific classes of documents and records. These schedules have been compiled using recognised best practice, guidance issued by the Information Commissioner's Office (ICO), National Association of Local Councils (NALC), Society of Local Council Clerks (SLCC), HM Revenue & Customs (HMRC), the Section 46 Code of Practice on the Management of Records issued under the Freedom of Information Act 2000, together with other relevant legislation and guidance.

Whenever there is the possibility of litigation, an insurance claim, an audit, a complaint, a Freedom of Information request, an Environmental Information Regulations request, a Subject Access Request, a criminal or regulatory investigation, or any other legal proceedings, any records likely to be relevant must not be amended, deleted or disposed of until the matter has been fully concluded and any applicable appeal periods have expired.

Document Disposal Protocol

Documents should only be disposed of after review in accordance with the following considerations:

Is retention required to fulfil statutory or other regulatory requirements?
Is retention required to meet the operational needs of the Council?
Is retention required for financial, taxation or audit purposes?
Is retention required to evidence events in the event of a dispute, complaint or legal claim?
Is retention required because the document or record is of historical, evidential or archival value?
Is the document subject to a legal hold or ongoing investigation?

When documents are scheduled for disposal, the method of disposal should be appropriate to the nature, sensitivity and confidentiality of the information concerned. A record of significant disposals should be maintained in accordance with the Council's accountability obligations under the UK GDPR.

Documents may be disposed of by one of the following methods:

Non confidential paper records: recycling or disposal through normal waste arrangements.
Confidential paper records or records containing personal, financial or commercially sensitive information: crosscut shredding or destruction by an approved confidential waste contractor.
Secure deletion of electronic records from Council devices, servers, cloud storage and approved business systems.
Secure deletion of emails and electronic communications in accordance with the Council's retention schedule.
Transfer of records of historical significance to the appropriate County Record Office or other recognised archive service.

The following principles should be followed when disposing of records:

All records containing personal, confidential or commercially sensitive information should be securely destroyed at the end of the retention period unless there is a lawful reason for continued retention.
Failure to dispose of personal information appropriately may result in breaches of the UK GDPR, the Data Protection Act 2018 or reputational damage to the Council.
Electronic records should be deleted in such a way that they cannot reasonably be reconstructed or recovered, following current Information Commissioner guidance.
Where documents are considered to be of historical or local significance, they should be considered for permanent preservation at the appropriate archive service.
Where practical, back-up copies of records should also be removed in accordance with the Council's ICT backup and disaster recovery arrangements once the retention period has expired.
Disposal of electronic devices containing Council information must include secure erasure or physical destruction of storage media where appropriate.

Records should be maintained of significant disposals. These records should contain the following information:

The name or description of the document or record destroyed.
The retention period applied.
The date the document was destroyed.
The method of disposal.
The person authorising the disposal.
Where applicable, the contractor responsible for destruction and any certificate of destruction received.

Data Protection Act 1998 – Obligation to Dispose of Certain Data

The UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 require that personal data must not be retained for longer than is necessary for the purpose for which it was originally collected. Personal data means any information relating to an identified or identifiable living individual and includes any information from which a person can be directly or indirectly identified. This includes expressions of opinion about an individual and any indication of the intentions of the Council or another person in respect of that individual.

The Data Protection Act 2018 provides exemptions that permit certain personal data to be retained for archiving in the public interest, scientific or historical research purposes, or statistical purposes, provided that appropriate safeguards are in place and the requirements of the UK GDPR are met.

The Council is responsible for ensuring that it complies with the principles of the UK General Data Protection Regulation (UK GDPR), namely that personal data shall be:

Processed lawfully, fairly and in a transparent manner.
Collected for specified, explicit and legitimate purposes and not further processed in a manner incompatible with those purposes.
Adequate, relevant and limited to what is necessary in relation to the purposes for which it is processed.
Accurate and, where necessary, kept up to date.
Kept in a form which permits identification of data subjects for no longer than is necessary.
Processed in a manner that ensures appropriate security, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage.
Processed in accordance with the rights of the data subject.
Managed in a manner that enables the Council to demonstrate compliance with the accountability principle, including maintaining appropriate records of processing activities where required.

Any external storage providers, archive services, cloud storage providers or contractors processing Council information on behalf of the Council must comply with the UK GDPR, the Data Protection Act 2018 and any contractual requirements relating to confidentiality, security and records management.

Scanning of Documents

Where appropriate, the Council may retain records electronically. Electronic document management systems should ensure that records remain authentic, reliable, accessible and secure throughout their retention period. There is no general legal requirement for local authorities to retain documents in paper format provided that the electronic version is a complete, accurate and accessible copy, except where legislation specifically requires the original document to be retained.

As a general rule, once a document has been successfully scanned, quality checked and stored within the Council's approved record management system, the original paper document may be destroyed after three months unless:

legislation requires the original to be retained;
the document has continuing legal or evidential value;
the document has historical significance; or
there is an ongoing legal hold, audit or investigation.

Original documents required for VAT, taxation, property ownership, legal proceedings or other statutory purposes shall be retained for the period prescribed by HM Revenue & Customs or other relevant legislation unless electronic retention is expressly permitted.

Review of Document Retention

This policy will be reviewed, updated and, where appropriate, amended at least every three years, or sooner if there are changes in legislation, statutory guidance, best practice or the operational requirements of the Council.

This document has been compiled from recognised best practice and with reference to the following legislation, guidance and publications:

UK General Data Protection Regulation (UK GDPR).
Data Protection Act 2018.
Freedom of Information Act 2000.
Environmental Information Regulations 2004.
Local Government Act 1972.
Local Audit and Accountability Act 2014.
Limitation Act 1980.
Information Commissioner's Office (ICO) guidance on records management and data protection.
Section 46 Code of Practice on the Management of Records issued under the Freedom of Information Act 2000.
HM Revenue & Customs record keeping requirements.
National Association of Local Councils (NALC) guidance.
Society of Local Council Clerks (SLCC) guidance.
Arnold-Baker on Local Council Administration (latest available edition)

Back to Policies