MW Security
Privacy Notice.

Document Control

Policy Title: Data Retention Policy

Version: 1.0

Approved By: Michael Wild / Principal Consultant

Approval Date: 12/04/2026

Review Frequency: Annual

Classification: Internal

1. Purpose

This policy defines how MW Security Consultants retains, stores, archives, and disposes of personal data and business records in accordance with UK GDPR, the Data Protection Act 2018, and the organisation’s Information Security Management System (ISMS). It ensures that data is kept only for as long as necessary, is securely protected throughout its lifecycle, and is disposed of safely when no longer required.

2. Scope

This policy applies to:

• All personal data processed by MW Security Consultants
• All client information received during consultancy engagements
• All business records, including financial, contractual, and operational documents
• All systems, devices, and cloud services used for storage
• All data processed as a data controller or data processor

The Principal Consultant is responsible for all retention and disposal activities.

3. Principles of Data Retention

MW Security Consultants follows these principles:

• Data minimisation — retain only what is necessary
• Purpose limitation — retain data only for the purpose it was collected
• Storage limitation — delete or anonymise data when no longer required
• Security — protect data throughout its lifecycle
• Accountability — maintain documented retention schedules

These principles align with UK GDPR Article 5.

4. Retention Schedule

Retention periods are based on:

• Legal requirements
• Contractual obligations
• Industry best practice
• Legitimate business needs

4.1 Client Engagement Data

Data Type	Retention Period	Rationale
Client contact details	6 years after final engagement	Contractual limitation period
Consultancy reports, assessments, and deliverables	6 years	Evidence of work performed
Risk assessments and treatment plans	6 Years	Professional and legal defence
Emails relating to engagements	3 years	Operational need
Client onboarding information	6 years	Contractual and audit requirements

4.2 Business & Financial Records

Data Type	Retention Period	Rationale
Invoices and financial records	6 years	HMRC requirement
Contracts and agreements	6 years	Legal limitation period
Insurance documents	6 years	Claims Defence
Supplier Records	3 years	Operational nees

4.3 Internal ISMS Records

Data Type	Retention Period	Rationale
Risk Register	3 years	ISMS evidence
Incident logs	3 years	Legal and audit requirements
Internal Audits	3 years	ISMS cycle
Management reviews	3 years	ISMS cycle
Policy versions	3 years after superseded	Audit trail

4.4 Marketing & Communications

Data Type	Retention Period	Rationale
Mailing list data	Until consent withdrawn	Consent-based processing
Enquiry emails	12 months	Business need

5. Secure Storage

All retained data is stored using:

• Encrypted devices
• Microsoft 365 secure cloud storage
• MFA-protected accounts
• Controlled access (Principal Consultant only)
• Secure configuration and patching

These controls align with the Information Security Policy and Annex A controls.

6. Secure Disposal

Data is securely disposed of when retention periods expire:

• Digital data — permanently deleted from cloud storage and devices
• Physical data — shredded or securely destroyed
• Backups — deleted in accordance with Microsoft 365 retention cycles

Disposal actions are recorded in the Data Disposal Log.

7. Data Subject Rights

Individuals may request:

• Deletion
• Restriction
• Correction
• Access

Requests are assessed against legal retention requirements.

Where retention is legally required, deletion may be refused with justification.

8. International Transfers

Data is retained within the UK where possible.

Where cloud services involve international transfers, appropriate safeguards (e.g., SCCs, adequacy decisions) are applied.

9. Roles and Responsibilities

• Principal Consultant
• Maintains the retention schedule
• Ensures secure storage and disposal
• Reviews retention periods annually
• Ensures compliance with UK GDPR

10. Review and Maintenance

This policy is reviewed annually or when:

• Legislation changes
• Business operations change
• New data types are introduced
• Risks or incidents indicate a need for revision

The Principal Consultant ensures the policy remains accurate and effective.