HMRC update records management, retention and disposal policy
Released 12 September 2018
HMRC have updated their policy on records management, retention and disposed to reflect the General Data Protection Regulations (GDPR) and Data Protection Act 2018.
Records Management and Retention and Disposal Policy outlines HMRC policy for managing records throughout their lifecycle. HMRC policy also applies to records that third parties manage on behalf of HMRC. The guidance has been updated at sections 4.1 HMRC retention policy, 4.2 Line of Business retention and disposal responsibilities and a new section 4.3 Retention requirements for personal data has been added. The default standard retention period for HMRC records is 6 years plus current, otherwise known as 6 years + 1. The maximum retention period for HMRC records identified as having historic value is defined as 20 years after the last entry in the record, with an additional one calendar year for final review and transfer or destruction. Records identified as having historic value may be transferred to The National Archives at 20 years + 1 or earlier. GDPR, Art. 5(1)(e) about storage limitation specifies that personal data shall be kept for no longer than is necessary for the purposes for which the personal data are processed. Personal data may be stored for longer periods insofar as it will be processed solely for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Art. 89(1) of GDPR.
For more information, see Records Management and Retention and Disposal Policy.