Retention and disposal schedules ICT and digital retention schedule

Published: 29 June 2026

Application Management

Application Procedures

  • Description: Not applicable
  • Retention period: 3 years
  • Action: Review
  • Reasoning: Business Requirement
  • Personal data: Yes
  • Special category data: Yes

Microsoft Power Platform

  • Description: Not applicable
  • Retention period: 6 years
  • Action: Review
  • Reasoning: Business Requirement
  • Personal data: No
  • Special category data: No

Schools

  • Description: Not applicable
  • Retention period: 6 years
  • Action: Delete
  • Reasoning: Business Requirement
  • Personal data: Yes
  • Special category data: No

Asset management

Disposal

  • Description: Disposition certificates, IT disposal register
  • Retention period: 2 years
  • Action: Delete
  • Reasoning: Business requirement
  • Personal data: No
  • Special category data: No

Asset acquisition

  • Description: Hardware and software acquisition forms
  • Retention period: 6 years
  • Action: Delete
  • Reasoning: Business requirement
  • Personal data: No
  • Special category data: No

Asset inventory

  • Description: Inventory of hardware and software
  • Retention period: 2 years
  • Action: Delete
  • Reasoning: Business requirement
  • Personal data: No
  • Special category data: No

Change control management

Procedures

  • Description: Governance of change management
  • Retention period: 3 years
  • Action: Delete
  • Reasoning: Business requirement
  • Personal data: No
  • Special category data: No

Cloud platforms

Office 365

  • Description: Not applicable
  • Retention period: 6 years
  • Action: Delete
  • Reasoning: Business requirement
  • Personal data: No
  • Special category data: No

Service management procedures

  • Description: Not applicable
  • Retention period: 6 years
  • Action: Review
  • Reasoning: Business requirement
  • Personal data: No
  • Special category data: No

Software as a service (SAAS)

  • Description: Plans, reports, installation and setup plans
  • Retention period: 6 years
  • Action: Delete
  • Reasoning: Business requirement
  • Personal data: No
  • Special category data: No

Contracts and Budgets

Budgets

  • Description: Not applicable
  • Retention period: 6 years
  • Action: Delete
  • Reasoning: Business Requirement
  • Personal data: No
  • Special category data: No

Contracts

  • Description: Software and Hardware contracts and associated documentation
  • Retention period: 6 years
  • Action: Review
  • Reasoning: Business Requirement
  • Personal data: No
  • Special category data: No

Microsoft Enterprise Agreements

  • Description: Not applicable
  • Retention period: 6 years
  • Action: Review
  • Reasoning: Business Requirement
  • Personal data: No
  • Special category data: No

Digital services

Communications

  • Description: Not applicable
  • Retention period: 6 years
  • Action: Review
  • Reasoning: Business requirement
  • Personal data: No
  • Special category data: No

Development

  • Description: Not applicable
  • Retention period: 6 years
  • Action: Review
  • Reasoning: Business requirement
  • Personal data: No
  • Special category data: No

Monitoring

  • Description: Not applicable
  • Retention period: 6 years
  • Action: Review
  • Reasoning: Business requirement
  • Personal data: No
  • Special category data: No

Project for web

  • Description: Not applicable
  • Retention period: 6 years
  • Action: Delete
  • Reasoning: Business requirement
  • Personal data: No
  • Special category data: No

Technical business analyst work

  • Description: Not applicable
  • Retention period: 6 years
  • Action: Delete
  • Reasoning: Business requirement
  • Personal data: No
  • Special category data: No

Website analytics

  • Description: Not applicable
  • Retention period: 6 years
  • Action: Review
  • Reasoning: Business requirement
  • Personal data: No
  • Special category data: No

Websites

  • Description: Not applicable
  • Retention period: 6 years
  • Action: Review
  • Reasoning: Business requirement
  • Personal data: No
  • Special category data: No

Managing communication

Landline and broadband

  • Description: Not applicable
  • Retention period: 6 years
  • Action: Delete
  • Reasoning: Business requirement
  • Personal data: No
  • Special category data: No

Telephony

  • Description: Not applicable
  • Retention period: 6 years
  • Action: Delete
  • Reasoning: Business requirement
  • Personal data: Yes
  • Special category data: No

Managing Infrastructure

Azure management

  • Description: Management of cloud servers and services
  • Retention period: 6 years
  • Action: Review
  • Reasoning: Business requirement
  • Personal data: No
  • Special category data: No

Compliance

  • Description: Compliance audits - PSN, NHS, Backups
  • Retention period: 6 years
  • Action: Delete
  • Reasoning: Business requirement
  • Personal data: No
  • Special category data: No

Desktop maintenance

  • Description: Not applicable
  • Retention period: 6 years
  • Action: Review
  • Reasoning: Business requirement
  • Personal data: No
  • Special category data: No

Desktop procedures

  • Description: Not applicable
  • Retention period: 3 years
  • Action: Review
  • Reasoning: Business requirement
  • Personal data: No
  • Special category data: No

Disaster recover and backups

  • Description: Not applicable
  • Retention period: 6 years
  • Action: Delete
  • Reasoning: Business requirement
  • Personal data: No
  • Special category data: No

Information security

  • Description: Not applicable
  • Retention period: 6 years
  • Action: Delete
  • Reasoning: Business requirement
  • Personal data: No
  • Special category data: No

IT audits

  • Description: Not applicable
  • Retention period: 6 years
  • Action: Delete
  • Reasoning: Business requirement
  • Personal data: No
  • Special category data: No

Network maintenance

  • Description: Not applicable
  • Retention period: 6 years
  • Action: Review
  • Reasoning: Business requirement
  • Personal data: No
  • Special category data: No

Server maintenance

  • Description: Not applicable
  • Retention period: 6 years
  • Action: Delete
  • Reasoning: Business requirement
  • Personal data: No
  • Special category data: No

Server procedures

  • Description: Not applicable
  • Retention period: 3 years
  • Action: Review
  • Reasoning: Business requirement
  • Personal data: No
  • Special category data: No

Service desk

  • Description: Not applicable
  • Retention period: 6 years
  • Action: Delete
  • Reasoning: Business requirement
  • Personal data: No
  • Special category data: No

Systems maintenance

  • Description: Not applicable
  • Retention period: 6 years
  • Action: Delete
  • Reasoning: Business requirement
  • Personal data: No
  • Special category data: No

Systems procedures

  • Description: Not applicable
  • Retention period: 3 years
  • Action: Review
  • Reasoning: Business requirement
  • Personal data: No
  • Special category data: No

Project management

Policies and strategies

  • Description: Not applicable
  • Retention period: 6 years
  • Action: Delete
  • Reasoning: Business requirement
  • Personal data: No
  • Special category data: No

Project templates

  • Description: Not applicable
  • Retention period: 6 years
  • Action: Delete
  • Reasoning: Business Requirement
  • Personal data: No
  • Special category data: No

Projects

  • Description: Not applicable
  • Retention period: 6 years
  • Action: Delete
  • Reasoning: Business requirement
  • Personal data: No
  • Special category data: No

Resource development

Project site reviews

  • Description: Project Site governance
  • Retention period: 6 years
  • Action: Delete
  • Reasoning: Business requirement
  • Personal data: No
  • Special category data: No

Service delivery

Customer service engagement

  • Description: Not applicable
  • Retention period: 3 years
  • Action: Delete
  • Reasoning: Business requirement
  • Personal data: No
  • Special category data: No

IT communications

  • Description: Not applicable
  • Retention period: 3 years
  • Action: Review
  • Reasoning: Business requirement
  • Personal data: No
  • Special category data: No

Serious incident reviews

  • Description: Not applicable
  • Retention period: 6 years
  • Action: Delete
  • Reasoning: Business requirement
  • Personal data: No
  • Special category data: No

Service catalogue

  • Description: Not applicable
  • Retention period: 6 years
  • Action: Review
  • Reasoning: Business requirement
  • Personal data: No
  • Special category data: No

Strategy

Maturity models

  • Description: Not applicable
  • Retention period: 6 years
  • Action: Delete
  • Reasoning: Business requirement
  • Personal data: No
  • Special category data: No

Policy

  • Description: Not applicable
  • Retention period: Permanent
  • Action: Permanent
  • Reasoning: Business requirement
  • Personal data: No
  • Special category data: No

Principles

  • Description: Not applicable
  • Retention period: 6 years
  • Action: Delete
  • Reasoning: Business requirement
  • Personal data: No
  • Special category data: No

Reports

  • Description: Not applicable
  • Retention period: 6 years
  • Action: Delete
  • Reasoning: Business requirement
  • Personal data: No
  • Special category data: No

Service planning

  • Description: Not applicable
  • Retention period: 6 years
  • Action: Delete
  • Reasoning: Business requirement
  • Personal data: No
  • Special category data: No

Standards

  • Description: Not applicable
  • Retention period: 6 years
  • Action: Delete
  • Reasoning: Business requirement
  • Personal data: No
  • Special category data: No

Technical strategy

  • Description: Not applicable
  • Retention period: 6 years
  • Action: Delete
  • Reasoning: Business requirement
  • Personal data: No
  • Special category data: No