Data retention: how long should you actually keep records?

Keep personal data only as long as you have a genuine business or legal reason to — indefinite retention "just in case" is itself a compliance risk, not a safety net. Different record types have different minimums (financial records typically longer, marketing consent shorter), so a simple retention schedule by document type is worth having.

Coach's tip: an annual clear-out of old starter and leaver files, old client data and stale marketing lists is a quick, low-effort compliance win.