Practical steps to be taken in retaining and destroying Personal Information Copy

Practical steps and guidelines:

• create a data inventory of all the Personal Information you Process in your business, including the categories of people you collect it from (e.g. clients, suppliers, children, etc), brief details of what Personal Information is collected from each category, and where this information is stored/kept (this may be in multiple locations).
• document and assess what type of Personal Information your business needs to keep (e.g. for business and historical purposes) and for how long. This must include Personal Information that is subject to a legislated document retention period and all other Personal Information not legislated.
• create or review existing document retention schedules and policies, setting out how long certain types of Personal Information must be retained for, how it must be stored/retained, and how it must be destroyed, and how your business will deal with information that needs to be restricted.
• Ensure that your businesses document retention schedule and policies are implemented throughout your business.