13.8 Retention and disposal

The organisation shall establish a retention schedule that reconciles:

legal and procedural requirements;

client and contractual requirements;

evidential and limitation needs;

continuing operational need;

data-protection storage limitation;

intellectual-property and licence restrictions; and

archive or public-record obligations.

At the end of the retention period, information shall be securely disposed of, anonymised or transferred to an authorised archive. Disposal shall be suspended where a legal hold, dispute, investigation, inquiry or continuing requirement applies.

Disposal and transfer shall be recorded.