Retention and Disposal Schedule

Are you unsure of how to long to retain your data and information?

A retention and disposal schedule describes the business that is done by an organisation and identifies classes of information created, received and used in pursuit of that business.

Retention and disposal practices have come under the spotlight because of high-profile data breaches involving customer data. This has led to more clients coming to us to help design retention and disposal schedules and implementation plans that can be applied to information and data in all forms. 

What is a retention and disposal schedule?

A retention and disposal schedule authorises minimum retention periods and disposal actions that may be carried out for specified classes of information, such as deletion or de-identification. 

Benefits of a retention and disposal schedule

Understand how long information and data needs to be retained

Destroy/delete information and data which have reached their minimum retention period

Reduce the risk/severity of a data breach by not over-retaining information and data


elevenM will work with you to build a retention and disposal schedule.  The steps below are the typical order in which the schedule is created.  

  1. Understanding the organisation and any current retention requirements/ documentation.
  2. Review legislation relevant to the organisation and the applicable retention periods.
  3. Speak to the business to understand their operational requirements for information.
  4. Populate the retention schedule using this information.
  5. Share the retention schedule for feedback.
  6. Finalise and hand over to client.

Frequently asked questions

Any organisation that collects personal or sensitive information, or information with associated legal or regulatory requirements, should have a Retention and Disposal Schedule, to ensure they are meeting their regulatory obligations

Let's talk

We work with every organisation individually to tailor our work to your needs.