Data retention
Document Retention Strategy & Policy
Hamlins LLP (“Hamlins“) is committed to protecting and respecting your privacy and is a limited liability partnership incorporated under the Limited Liability Partnership Act 2000 with the registered number OC314426 and our registered office at 1 Kingsway, London, WC2B 6AN.
In the large majority of circumstances, the data controller is likely to be Hamlins. If you have any questions regarding this policy, you should contact Hamlins in the first instance via enquiries@hamlins.com or at the following address:
The Data Protection Officer
Hamlins LLP
1 Kingsway
London
WC2B 6AN
Introduction
- Information and data is one of Hamlins’ key corporate assets. In the course of carrying out its various functions, Hamlins accumulates information from both individuals and external organisations. Hamlins also generates a wide range of data, which is recorded in documents and records. Hamlins strives to maintain data in accordance with the Act.
- These documents and records are in several different formats, examples of which include, (but are not limited to) communications such as emails, file notes, attendance notes, press releases and information relating to our clients, our business, our commercial partners and suppliers, representations and partners of the business.
- For the purposes of this Policy, the terms ‘document’, ‘data’ and ‘records’ include information in both hard copy and electronic form.
- In certain circumstances, it will be necessary to retain specific documents in order to fulfil statutory or regulatory requirements and also to meet justifiable operational needs. Document retention may also be useful to evidence events or agreements in the case of disputes, and also to preserve information which has historic value. Hamlins has developed this Policy with the intention of benefitting Hamlins and the data subjects to strike a careful balance between legal obligations, operational efficiency and retention of data for periods which are reasonable and appropriate in the circumstances.
- Hamlins will retain some data and forms of information for longer than others. In line with principle 5 of the Act, information is not sought to be kept longer than is necessary.
- The retention of all documents and records is impractical and appropriate disposal forms an important aspect of this Policy. Disposal will assist Hamlins to maintain sufficient electronic and office storage space and will de-clutter office accommodation. Hamlins operates a ‘paper light’ approach to hard copy documents with the large majority of records being retained electronically rather than as hard copies where possible. Hamlins’s Policy schedule is a tool used to ensure the retention of business information, personal data and sensitive personal data for as long as it is needed and justified in accordance with our balanced approach referred to in paragraph 4 above. Hamlins is keen to be transparent and proactive to provide data subjects with transparency on how data will be retained by Hamlins and ultimately destroyed. This Data Retention Strategy should be read in combination with our Privacy Policy. It takes account of the context within which Hamlins operates, including the legal and regulatory environment, for example, compliance with the fifth data protection principle, the expectations of stakeholders and Hamlins’s ongoing legal obligations. It is intended primarily as a resource to inform you about how data is held, processed, archived and destroyed to enable disposal activity to be carried out in a consistent and controlled manner. A table containing the intended retention period is given for each relevant data category. The retention period applies to all records in that category default, and will be adhered to wherever possible, although it is recognised by Hamlins that there may be exceptional circumstances which require documents to be kept for either shorter or longer periods. In addition, it should be noted that, in line with the Act and Hamlins’s obligation to implement appropriate physical and technical security measures, the data and information held by Hamlins electronically is regularly and periodically backed up. These back-up copies are maintained indefinitely and in accordance with Hamlins’s Security Policy to ensure the consistency and stable framework upon which Hamlins operates its business. On this basis, these back-up copies are unaffected by the retention periods for each relevant data category which form part of this Policy. The data set which forms part of each back-up copy will be unaffected by the retention periods and action taken in line with the retention periods as referred to below. Retention periods also apply to all formats of records, i.e. paper and electronic, unless specifically stated otherwise.
The primary factors that inform decisions on retention are:
- Business need.
- Our ongoing obligations to our clients.
- Services provided to our clients.
- The provision of professional services to maintain our professional conduct requirements.
- Our experience of when retention of information and data is likely to be beneficial to the data subject as relevant to the specific services they seek from Hamlins, including acting as an ongoing record-keeping source relating to our clients and the matters we undertake on our clients’ behalf.
- Legislative and regulatory requirements, for example, compliance with the fifth data protection principle, where relevant legislation is listed.
- Informed and express consent of the data subject.
In our experience, data subjects are often keen to consent to Hamlins maintaining data and information beyond the periods referred to as part of this Policy. The reason and justification for these extended periods of retention, by way of example, can include:
- Provision of extended record keeping services.
- Removing an administrative burden from data subjects.
- Enabling an ease of operation between Hamlins and the data subject.
- Maintaining an ongoing business relationship, which may be limited to matters such as a data subject’s ongoing interest in Hamlins, including attendance at events operated on an annual basis.
It is therefore not unusual for data subjects to provide free and unambiguous consent to Hamlins to retain data beyond the periods forming part of this Policy.
Data Retention Schedule – Summary
1. Purpose of this document
A vital part of Hamlins’s Data Protection Policy and practice is for personal data to be retained for the appropriate period of time – neither too long nor too short. It is Hamlins’s policy to retain all information only for as long as specified in the Data Retention Schedule and, in general, no longer than six years plus the current year.
This document is a summary of the Data Retention Schedule, and gives an indication of the categories of personal data held by Hamlins and the basis on which Hamlins often retains data and information for longer than the six years stipulated in the Policy.
2. Current plus six-year rule
Personal data is not usually held for more than six years after it ceases to be current, unless there is a specific reason for doing so (see below for the specific categories requiring different retention periods). The definition of ‘current’ will vary according to the personal data: for example, it will mean until a Hamlins event has taken place, the completion of a matter, or until a member of staff has ceased being employed by Hamlins where it relates to staff. The ‘current plus six years’ rule is a target period for retention. If there is no need to keep the personal data that long, then it may be disposed of securely before the six years’ time-limit. Hamlins will aim to assess and update data held in accordance with this Policy on a quarterly basis, which means the six-year plus current rule will ultimately be subject to this quarterly variance.
3. Exceptions to the six-year rule
This section gives a guide to the categories which have legislation determining the length of time for which personal data within that category should be retained. An indication is given to the main section of the Data Retention Schedule dealing with this category. View the Data Retention categories here.
Given our experience of document and data retention, Hamlins operates a Policy where usually data is firstly archived. Archived data can then either become live data on the basis of repeated operation or alternatively can lead to deletion of the data after the periods of retention forming part of this Policy. Data which is archived is held on the following basis:
- Once data has been archived this means it will not be actively used by Hamlins, unless the data becomes current and/or the data subject requests such data to become current.
- Once data becomes current again, the six year plus current year rule will be reapplied to such data.
- Data which has been archived will generally remain archived for six years and will then be destroyed or anonymised.
A full breakdown of Data Retention periods can be found here.
Last updated: 21 April 2023