Task 5 — Retention Periods & Transfers

How long do you keep it — and does it leave the country or the group?

Complete each processing activity with its retention period and its transfers. They are the basis for the retention schedule in Workshop 6 and the transfer checks in Workshop 10.

What to document

Retention period: a fixed period or the criteria to determine it, and the event that starts it (e.g. end of contract)
Transfers to other countries: the recipient countries, including cloud services and support teams with access from abroad
Transfers within the group: e.g. a shared HR or CRM system run by the parent company

In ResGuard: transfers are recorded in Supplier Management, the module for third parties and vendors. Create each recipient there, such as a vendor, a group company or another third party, with its country, and link it to the processing activity in the RoPA.

Transfers in your jurisdiction

Switzerland

Disclosure abroad is allowed to countries the Federal Council lists as adequate (including the EU/EEA and the UK, and US companies certified under the Swiss-US Data Privacy Framework). Otherwise, safeguards are needed, e.g. standard contractual clauses recognised by the FDPIC (the EU SCCs with Swiss adaptations) or binding corporate rules, or an exception such as consent. Processors need a contract, and sub-processors require the controller's prior approval.

Example: retention and transfers

Processing activity	Retention period	Transfers
Payroll	Period required by tax and social security law, from the end of the year	Payroll provider in the same country
Recruitment	A few months after the position is filled, longer only with the applicant's consent	None
Newsletter	Until consent is withdrawn	E-mail marketing service hosted abroad
CRM	Duration of the customer relationship plus statutory periods	Group CRM operated by the parent company

The exact periods depend on your tax, accounting and employment laws — record the law next to each period.