Data retention
Retention policy
You should decide on how long you will retain the different categories of personal data and set out your retention periods in your ROPA. You should also set out how you will erase or dispose of personal data whether held electronically or in paper form.
For many firms, this issue will be challenging. Solicitors like to hold onto files. The Law Society of Scotland has Guidance on the Ownership and Destruction of Files.
This states:
"A solicitor’s obligations to comply with GDPR need to be considered when deciding the specific date beyond which the obligation to hold a client's own documents can be said to expire."
Our advice is to create a plan in relation to retention and work towards compliance based on a risk based analysis of the personal data you hold. Focus on the most risky areas of data processing i.e. any files holding health or criminal offence data.
Then ensure that you monitor compliance with this plan and record this in your record of processing.
Retention periods
The UK GDPR states that personal data should be kept for no longer than necessary for the purpose for which it was processed. Data subjects must now be provided with information about the retention period for personal data at the point that data is collected, through the privacy notice.
As part of your record of processing, you will require to identify what personal data you hold, the purpose for which it is held and the relevant retention period for that personal data.
Law Society of Scotland guidance
In relation to the files you hold about your clients, the Law Society of Scotland has issued suggested timings for file retention as follows, although, each firm is free to use this guide or select other retention periods as they see fit:
| Simple Debt Collection | Ten years after final completion i.e. after the time for appeal has elapsed. |
| Divorce and consistorial matters | Ten years after final completion, e.g. after maintenance, residence and contact orders, etc, have ceased to have effect, or children have reached majority. |
| Civil court cases | Ten years after completion. |
| Criminal cases | - Summary cases Files in respect of summary cases should be retained for three years following the date of conclusion of proceedings. - Solemn cases In solemn cases resulting in conviction files should be retained for the duration of the custodial sentence if it is more than three years in length. If the client is acquitted or the sentence is one of less than 3 years in length the files should be retained for three years from the date of conclusion of proceedings. If the case is neither indicted nor reduced to summary complaint the file should be kept for a three year period beginning one year after the date of first appearance on petition (or three years from the date that written confirmation is received from the Crown that there are to be ‘no further proceedings’). In murder cases and other cases involving disposal by way of life imprisonment (such as the imposition of an Order for Lifelong Restriction) all papers should be retained indefinitely. |
| Executries | The retention period may be of particular importance in cases where no clear decision has been taken to discharge legal rights. Files should be retained for the period which is the later of: (i) Twenty years after the date of the approval of the "final" accounts of the executry; or (ii) Two years from the death of the deceased's spouse or civil partner (if applicable) Relevant documents and papers may, by agreement, be sent to the Executor for safekeeping since prior rights and legal rights only prescribe if not claimed in the twenty years after becoming enforceable. |
| Continuing trusts | Ten years after the termination of the Trust. |
| Conveyancing transactions | The following suggested timings are primarily aimed at residential conveyancing files as we are aware that commercial firms generally have their own policies. However, these periods may be used for commercial transactions if a firm decides that they wish to do so. Purchase: Ten years after completion-although the file may be of use until the property is subsequently disposed of. Sale: One year later after completion (i.e. after implementing Letter of Obligation; dealing with any funds retained; and after Missives have ceased to have effect). Solicitors should be vigilant to the fact that there may be obligations placed upon them to retain files by other bodies, such as UK Finance, and should ensure that these obligations are complied with. |
| Company work | Ten years after completion. |
| Endowment and investment business | Given the nature of this work endowment and investment business files should be retained in line with the guidance provided by the Financial Conduct Authority. |
| Other correspondence files | Five years after completion of the business. |
| Financial records | Law firms should also be aware that “the required retention period” for accounting records is defined by Rule B6.1.1 as being, the “remainder of the financial year of the practice unit and a further six financial years”. Documents containing client's tax and VAT affairs must be retained for at least the relevant statutory periods. Compliance with HMRC required retention periods or other statutory requirements for retention of certain financial documents should be borne in mind when firms are considering how long to retain documents for. If, for any reason, a situation was to arise whereby the statutory retention period conflicts with the Society’s guidance on retention periods firms should comply with the statutory requirement. |
| Money laundering - customer due diligence records | Firms should be aware of the retention requirements of Regulation 40 of The Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017. |
| Closing of files | In cases where the matter in which a solicitor was instructed has not come to an obvious and natural conclusion there is a professional duty upon a solicitor to advise a client in writing that the file will be closed in the absence of their instructions within a specific, reasonable period of time. This is clearly sound common sense in the situation where the solicitor is sitting waiting for further instructions. This allows for dormant files to be closed, accounts to be rendered either to the client or SLAB and both solicitor and client know the matter has come to an end. However, there are cases such as old conveyancing transactions after the delivery of the Search and other cases where the matter is obviously concluded where the duty is not the same. |
| Records of Destruction | When files, papers and/or documents are destroyed a separate record should be retained of the date of destruction which should include a general description of what was destroyed. |
It is important to note that this will only deal with client files and will provide guidance on different types of client files. The onus is on each organisation to decide how long to keep personal data under data protection laws, although the retention period should be guided by legal requirements and professional guidelines. The Information Commissioner’s Office states that if an organisation keeps personal data to comply with a requirement like this, it will not be considered to have kept the information for longer than necessary.
There will be several examples within the sector where the guidance is that papers should be kept indefinitely because it is very difficult to predict when they may still be required for the purpose of providing legal advice. This should be reviewed on a systematic basis.
Consideration will also have to be given to how long human resources records are retained in relation to staff.
Case study
Our high street firm already has a system in place for how long files are retained. It is using the record of processing to review the retention times for each type of case and other types of data. As our high street firm deals with family law, some of these files contain more sensitive information and these have been prioritised.
Our firm is recording the retention times in the record of processing.