Data Retention & Disposal
Personal data must not be kept once it no longer serves its purpose. This workshop turns the retention periods from the inventory into a retention schedule, defines how data is disposed of and carries out the first review.
Workshop 6 video
Quick intro with a screen recording of the tasks — coming soon
What ResGuard provides
- Retention periods taken directly from your RoPA
- Retention Review module to document every review and its result
- Template for the retention and deletion procedure, including legal holds
- Guidance on statutory periods and deletion methods in every task
Workshop tasks
-
1. Create the retention schedule
Start from the inventory periods, check legal obligations (tax, accounting, employment) and define the event that starts each period.
In ResGuard: Data Inventory -
2. Disposal & anonymisation methods
Define per system how data is disposed of: automatic rules, manual steps with an owner, anonymisation, backups and secure destruction of paper.
-
3. Set up reviews
Appoint owners per department and repeat the reviews at least every six months. ResGuard sends automatic reminders.
In ResGuard: Retention Review -
4. First retention review
Find data that is already past its retention period, including shared folders and old mailboxes, check for exceptions and dispose of it.
In ResGuard: Retention Review -
5. Legal holds & exceptions
Define how disposal is suspended for litigation, investigations or audits, who orders it and how it is lifted.
In ResGuard: Policy Framework -
6. Workshop review & close-out
Review the results, attach evidence and close the objective in ResGuard.
In ResGuard: Objective Manager
What to keep in mind under the PDPA
- The PDPA sets no fixed retention periods: stop retaining personal data, or anonymise it, as soon as it no longer serves its purpose and is not needed for legal or business purposes.
- Check the periods required by other laws first, for example the Companies Act and Income Tax Act (typically five years for accounting and tax records) and the Employment Act record-keeping rules.
Expected result
- Retention schedule approved
- Disposal methods defined per system
- Retention reviews set up in Retention Review
- First review carried out and documented
ResGuard modules: Retention Review, Data Inventory (RoPA), Policy Framework