Data Retention and Deletion

Retention criteria Retention depends on the record type, service obligations, legal duties, disputes, warranties and legitimate operational necessity. Final periods require a documented schedule. Deletion and anonymisation At the end of an approved retention period, records should be securely erased or anonymised unless continued retention is required. Backups and logs Backup rotation, audit logs, payment records and externally controlled systems may have separate authorised retention windows. Requests and exceptions A verified deletion request must be routed to the responsible data owner, with recorded outcomes and any lawful reason for retaining specific records.