Data Retention Policy

Procedures

Filing and archiving

Filing must generally be kept in an orderly manner and capable of being easily accessed. Where space, security and health and safety considerations allow, documents should be kept on site. Where this is not feasible and the business needs to store records offsite, the approved archiving facility arrangements should be used. For further details please contact Data Protection Team or Group Legal Counsel.

The approved archiving supplier is the only off site archiving facility to be used for future archiving requirements after issue of this Policy. Where any other third party archiving facility is currently being used, you must ensure that adequate security and document destruction processes are in place otherwise, the archived documents should be transferred to the approved archiving supplier. Daily bank records should be kept in a secure office and only authorised accounting personnel should have access to this information. Accounting personnel should not allow these documents to be accessed by any unauthorised members of staff without prior consent of the Accountant or Financial Controller. When these records are archived they should be marked ‘Confidential’.

Archived documents held onsite should be retained in a locked room or cabinet and should only be accessible by authorised personnel. When transferring to an offsite facility, the approved supplier will collect the barcoded records and provide a consignment note to track the records into storage.

Retrieval of any records from the approved supplier or other offsite archive facility must be authorised by the Accountant, Financial Controller or Group Legal Counsel, and securely stored on receipt.

It is very important to note that documents which have been stored in an archive facility are still subject to the data retention periods and the data destruction process outlined in this policy. Care must be taken to ensure that these records are still reviewed periodically to assess whether destruction is required. 

Security of documents

All colleagues are responsible for ensuring that any documents held on site or accessed through computers on site are kept securely and that they are not disclosed to any unauthorised third party, particularly if they contain commercially sensitive data or personal data.

Dependent on the sensitivity and value of the documents, appropriate physical measures should be taken for storage and access which may include:
• lockable room with controlled access;
• locked drawer or filing cabinet;
• not leaving documents unattended in public areas;
• complying with a ‘clear desk’ policy;
• if electronic, are password protected, with controlled distribution;
• password protected screen-savers: user names and passwords must not be shared;
• PC, laptop and terminal screens are not visible to the public.

Document Destruction

Group Legal Counsel and the heads of each business area are responsible for ensuring that documents are periodically reviewed (at least annually) to determine whether any retention periods applying to documents within their business (including those that are archived) have expired. This task may be delegated by the Group Legal Counsel and/or the relevant heads of each business area to senior employees. Once the retention period has expired, the document must be reviewed and an action agreed, which is either:

a) the destruction and/or deletion of the document or
record; or
b) the retention of the document or record for a further
period within the business.

The decision must be reached having regard to:

• on-going business and accountability needs (including audit and potential litigation);
• current applicable legislation;
• best practice in the applicable professional field (for example health and safety);
• costs associated with continued storage versus costs of destruction;
• the legal, political and reputational risks associated with keeping, destroying or losing control over the record.

Decisions must not be made with the intent of denying access or destroying evidence.

Deletion of Electronic Records

Inchcape has an IT system tool to help us locate and identify certain electronic documents (such as Word or Excel files) that are stored on servers in networked shared or user folders that exceed the stated retention periods in this policy. Once identified, the tool may be used to delete such identified records. The tool is not a replacement for ‘good housekeeping’ however and colleagues must still assume responsibility for ensuring that this Data Retention Policy is adhered to, particularly where they are documents which are not able to be identified within the tool (such as scanned documents, pictures, Project or Visio documents).

Any computer equipment should also be disposed of through the IS&T Department to ensure any storage media is wiped or physically destroyed in a secure manner.

It is essential that all colleagues follow the Inchcape Information Security Policies regarding storage of electronic data. If you have stored personal data that is not business-related, Inchcape will not be held responsible for the loss of any information that is not business-related during this destruction process.

Deletion of Emails and Attachments

Emails and the attachments stored within them are just as important to this policy as electronic or paper records. Emails often attach the same documents that may well have required deletion in accordance with the principle of electronic record deletion above.

It is also important to remember that emails may also hold the only copy of an important document so care must be taken to ensure that documents which need to be retained are removed from emails and stored in an appropriate location. Colleagues must ensure that they carefully consider the retention periods for the emails and attachments within them when reviewing compliance with this policy.

Like the process for destruction of electronic documents, it is essential that all colleagues follow the Inchcape Information Security and Acceptable Usage Policies regarding storage and archiving of emails and attachments. If you have stored personal emails and attachments to them that are not business-related, Inchcape will not be held responsible for the loss of any information that is not business-related during this deletion process.