To have and to hold: Be richer not poorer through better data management

We all know that handling personal data is part of doing business, but it comes with responsibility. A strong data retention and deletion policy isn’t just about ticking compliance boxes; it’s about protecting privacy, reducing risk, and managing information smartly throughout its lifecycle.

Risk vs reward

For wealth management firms, managing client data isn’t always straightforward. Different regulations can make the rules around retention and deletion feel complicated, and older systems don’t always play nicely with newer ones.  Without a clear process, companies risk holding on to information longer than they should, which can increase exposure to breaches or compliance issues.  It takes effort to get it right, but the payoff is worth it.

When firms establish strong data retention and deletion practices the benefits are immediate and tangible.  Clients gain confidence knowing their sensitive financial details are handled responsibly, while companies save money by reducing unnecessary storage and improving system performance,  Beyond efficiency, good data governance sets a firm apart, showing clients (and regulators) that the company takes privacy and compliance seriously.  In a competitive industry that kind of trust and credibility can be a real differentiator.

Whose responsibility is it?

Managing personal data is a team effort, but the ultimate responsibility sits with the data controller. These are the people who decide why and how data is processed, including how long it’s kept and how it’s securely disposed of.

Your Data Protection Officer (DPO) or data protection team can help advise on lawful retention periods, roles and responsibilities and secure deletion practices. They will also help monitor your compliance with the storage limitation principle, support development of data retention and deletion policies and may conduct audits or assessments to evaluate retention risks.

Data governance or records management teams should maintain a data retention schedule and coordinate periodic reviews to make sure it is up to date. Where possible these teams should support classification and tagging of the data within your organisation.

Information asset owners are operationally responsible for applying retention rules to the data that they manage and they will help to ensure that data is reviewed, archived or deleted in line with the company’s data retention schedule.
IT or Information Security teams should be able to help with implementing automated retention and deletion mechanism in systems.  They will also provide methods for secure deletion of data (e.g. cryptographic wiping and certified destruction).  

All staff must be aware of data retention policies and be provided with training particularly if they work within one of the above roles.  

Collecting and storing data

The overriding data retention principle in the majority of cases is to keep personal data only as long as necessary for the purpose it was collected.

It is essential that companies collect only what is necessary for their stated purpose.  Unless absolutely necessary, avoid gathering or keeping sensitive personal information longer than required.  When asking individuals for their consent you should try to use clear, understandable language and implement a consent management process for tracking and updates.

When deleting data consider what other systems or data repositories the data is stored including information that is backed-up.  It may be that the data flows from one system to another so mapping data flows and applying equal classification and tagging rules will greatly assist in deleting all necessary data.

Recording personal data on paper is subject to the same rules as digital data.

Always store paper files in a secure, lockable cabinet and label files by category and retention period.  Disposal methods such as shredding or certified destruction should be applied.

Automate where possible

It is helpful to use retention management software that enforce data retention schedules and trigger secure deletion automatically.  Tagging data by category (i.e. personal data, sensitivity of data) will also help to streamline data lifecycle management. 

Benefits of an effective data retention schedule

•    Legal compliance: avoiding fines and penalties associated with non-compliance with data protection legislation
•    Enhanced data security: minimising the risk of data breaches and unauthorised access through structured retention and disposal policies
•    Operational management: streamlining of data management processes and reducing storage costs
•    Customer trust: building customer trust by demonstrating a commitment to protection of their privacy rights.

Understanding data retention is essential to business success in today’s highly digitised world.  By implementing an effective data retention policy, organisations are much better placed to leverage their data as a valuable asset.