A data retention policy should explain purposes, record types, when the retention period starts, and routine deletion and exceptions. Periods for personal data depend on purpose, record type and regulatory requirements, so one deadline cannot cover every record.
For AI optimisation (AIO), make those answers explicit rather than leaving buyers or AI search tools to interpret vague wording. Start with your actual retention process, including documented exceptions, then turn it into clear public information.
What your data retention policy needs to say
A useful retention page answers a practical buyer question: what happens to our personal data after we stop using your service?
Explain routine storage and what happens at the end of a retention period. Keep these details separate from legal claims, regulatory requirements and backup handling. A sentence saying “we retain information as necessary” gives the reader little to work with.
Separate your policy from your schedule
Your policy describes the overall approach, staff responsibilities, approval process and exceptions. Your internal retention schedule, also called a disposal schedule, sets out each record class and its end-of-period action.
The public page should summarise the details customers need to understand. Your internal schedule can include system names, owners and operational controls that don’t belong on a website.
A privacy notice has a broader purpose. It explains how you process personal information rather than documenting every disposal task. Our privacy policy is a separate destination for information about how we handle website users’ data.
Give each record class an owner
Each schedule entry needs a record class, retention period and end-of-period action, such as deletion or archiving. Add the processing purpose, justification, starting event and responsible owner.
“Six years” is incomplete without its starting event. Six years after an accounting period ends is different from six years after a customer signs up.
Assign responsibility for approving exceptions and carrying out each end-of-period action. Otherwise, your published deadline can drift away from what happens in the CRM.
Choose storage periods by purpose, not habit
Start with necessity and legal duties
The UK GDPR storage limitation principle requires you to keep identifiable personal data no longer than necessary for its purpose. GDPR doesn’t prescribe fixed deadlines for different data types.
The ICO’s storage limitation guidance explains that you must decide appropriate periods. Document why each data retention period fits the processing purpose and legal requirements. The ICO also advises reviewing periods when purposes change.
Treat enquiry details, invoices, recordings and account logs separately. They support different activities and don’t automatically need matching lifetimes.
For PPC reporting, you may still need aggregate campaign results after identifiable lead records have lost their purpose. Keep that distinction in your schedule.
Consent isn’t the only lawful basis, and obtaining consent doesn’t justify indefinite retention.
Distinguish anonymisation from removing names
Genuinely anonymous information falls outside the UK GDPR and can be kept indefinitely under those rules. Removing a name or email address alone doesn’t establish anonymity.
Job titles, employers, recordings and detailed comments can still identify someone when combined with other information. Pseudonymised records still fall under the UK GDPR.
Your page should say you’ve anonymised records only where the process makes them genuinely anonymous. If records remain linkable to individuals, apply appropriate retention controls.
This also matters for research reports. Keep useful findings without retaining unnecessary participant-level information.
A sample UK retention schedule
Use a retention schedule that separates legal requirements from purpose-based decisions. The periods below are examples, not universal rules. Set a retention period for each record class, and check the ICO’s guidance when deciding how long personal data should remain in storage.
| Record class | Period or starting event | Reason for retention | End-of-period action |
|---|---|---|---|
| Company accounting and tax records | Normally six years after the end of the financial year they relate to | Company tax and accounting obligations | Secure disposal unless a longer requirement applies |
| Unconverted B2B enquiries | A documented period linked to the sales follow-up purpose | Managing relevant enquiries | Delete identifiable records when no longer needed |
| Customer account information | A documented period following closure, separated from tax records | Account administration and justified post-contract needs | Delete or anonymise |
| Call recordings and transcripts | A documented period matching coaching, support or compliance purposes | The stated recording purpose | Delete recordings and associated transcripts |
| Website session recordings | A short, justified period linked to research or support | Understanding specific service problems | Delete recordings and unnecessary exports |
| Marketing suppression records | As necessary to respect an objection | Preventing unwanted marketing | Retain only the minimum suppression information |
For accounting records, GOV.UK’s company records guidance states six years after the end of the relevant financial year, with circumstances requiring longer retention.
“Six years plus the current year” is common shorthand and can mean roughly seven years. It isn’t a universal seven-year Companies Act rule, and it doesn’t apply to every customer record.
For paper records, document secure destruction as the end-of-period action. Include removable media in the destruction process, and set out how digital copies are deleted.
For marketing data, the source of the enquiry doesn’t determine its lifetime. Leads collected through Google Ads need the same purpose-led decisions as enquiries arriving through other channels.
Use public-sector schedules without copying their deadlines
The CMA’s data retention policy shows how different record classes can receive different disposal decisions.
Its tiers include two years before destruction; six, ten and fifteen years before review; and permanent preservation. Selected records are transferred to The National Archives within twenty years of creation.
These are CMA records-management arrangements. They aren’t default retention periods for your private business.
Apply the same record-classification approach to your business’s disposal decisions: classify records, document the reason, specify the period and state what happens next. Don’t copy the deadlines because a government organisation uses them.
Long-lived staff records also need careful explanation. The National Archives’ model personnel schedule includes documents affecting pension entitlement retained for one hundred years from an employee’s date of birth.
That guidance applies to particular pension-related documents, not every employee file. Split HR records by purpose rather than applying one deadline to the whole folder.
Explain deletion across live systems and backups
Describe routine disposal clearly
At the end of a justified storage period, delete or anonymise personal data unless a documented exception applies. The ICO’s storage limitation guidance says information should be kept no longer than necessary.
Explain whether deletion is automated, scheduled or triggered by account closure. Include connected systems and copies in your process. Deleting a CRM record doesn’t automatically remove spreadsheet exports, recordings, support attachments or supplier-held copies.
For enquiries generated through Facebook Ads, identify where lead exports and integrations create additional records. Those copies need their own controls too.
Record the action and date, including any destruction of exported copies, without recreating the information you intended to remove.
Explain backup expiry honestly
Backups often follow a separate rotation cycle. Your data retention page should distinguish removal from active systems from the later expiry of backup copies.
Describe the actual timetable and access restrictions. Until expiry, deleted information should be beyond ordinary use, rather than available for ongoing sales, analysis or support.
If a backup is restored, your recovery process needs to reapply relevant deletion instructions. Otherwise, information removed last month can return to production.
Avoid promising immediate removal everywhere unless your systems support it. A clear explanation of staged removal is more useful than an absolute promise your infrastructure cannot deliver.
Keep exceptions narrow and recorded
Preserve records needed for claims or regulation
Routine disposal may need to pause when records are required for legal claims, investigations or regulatory requirements.
Document the reason, affected records, owner and review point. Restrict access and limit destruction to records outside the exception.
Explain this plainly on your public page. Account closure can trigger ordinary disposal whilst certain transaction records remain subject to tax obligations.
An exception shouldn’t become an excuse to retain an entire customer account indefinitely. Separate the information required for the obligation from information that has no continuing purpose.
Protect information covered by requests
FOIA duties primarily apply to public authorities, not every B2B website. They can also apply when you hold information on an authority’s behalf.
Section 77 makes intentional alteration, erasure, destruction or concealment to prevent disclosure of requested information an offence.
The ICO’s retention and destruction guidance describes a Town Clerk convicted in March 2020, fined £400 and ordered to pay £1,493 in costs.
Preserve information covered by a FOIA request. The ICO recommends retaining it for at least six months after internal review, once you’re confident no further action will follow. Unresolved complaints or appeals require continued preservation under the ICO’s guidance.
Your FOIA preservation process needs a way to identify affected records and pause deletion where preservation is required.
State who controls supplier retention
Your page should distinguish your responsibilities from those of your suppliers.
A controller determines the purposes and means of processing, including appropriate retention periods. Processors and sub-processors follow the relevant instructions and contractual arrangements.
Your role can differ between activities. You may process customer-controlled service data while acting as controller for your own billing or marketing information.
Your data-processing agreement should set out return or deletion arrangements, existing copies, backup handling and any legally required storage. Give buyers a clear route to the relevant contractual information.
For recordings, transcripts and AI retrieval systems, include supplier-held copies in your process. Restrict access by role and remove sensitive fields before capture where possible.
UK hosting alone doesn’t establish compliance. Buyers also need to understand retention controls, deletion options and their own configuration responsibilities.
Make your retention page useful for AI answers
Put complete answers beside clear questions
For AIO, structure the page around questions buyers ask: how long is customer data stored, when does deletion begin, and what remains in backups?
Answer each question directly. State the record type, retention period, starting event and any exception together, so readers and AI systems can interpret the storage limitation correctly.
Use a concise table alongside explanatory paragraphs. Keep each deadline and its qualification together, rather than separating them by several screens.
This follows the same intent-led approach used in SEO: answer the underlying question with enough detail to be useful. Formatting can’t guarantee inclusion in an AI-generated answer.
Keep public answers separate from customer records
Give the page a named content owner, jurisdiction and review date. Update the published wording when systems, contracts or retention decisions change.
If you use an AI retrieval system, index approved policy material rather than raw customer records, call transcripts or support tickets. Apply permissions when retrieval happens.
Remove superseded versions from active retrieval sources so an assistant doesn’t quote an old retention timetable. Keep an audit trail separately where justified.
The aim is straightforward: buyers and AI tools should receive the same current, approved answer.
Frequently Asked Questions
What should a data retention policy include?
It should explain the purposes for keeping data, the record types covered, when each retention period starts, and what happens at the end of that period. It should also describe routine deletion and documented exceptions.
How should a business choose retention periods?
Set a period for each record class based on its purpose and applicable legal requirements. The UK GDPR doesn’t prescribe fixed deadlines for different data types, so document why each period is appropriate.
What happens to data in backups after deletion?
Explain how removal from active systems differs from backup expiry, including the actual backup timetable and access restrictions. If a backup is restored, reapply relevant deletion instructions before the information returns to production.
When can a business keep records beyond the usual period?
Retention may need to pause when records are required for legal claims, investigations or regulatory requirements. Record the reason, affected information, responsible owner and review point, and limit the exception to the records that are required.
Turn your retention rules into a usable page
A data retention policy should make disposal rules and exceptions clear enough for teams to follow.
Start with your schedule, map the systems holding each record class, then publish commitments the business can meet. Published promises need matching processes.
If you need help making technical B2B information easier to find and understand, speak to us about Digital marketing.
