Data retention periods under UK GDPR
UK GDPR requires personal data to be kept no longer than necessary for its original purpose. Without a documented retention schedule, the default is often indefinite retention — which is itself a breach. For AML-regulated firms, the conflict between MLR 2017 retention obligations and UK GDPR must be documented and resolved.
The storage limitation principle
Article 5(1)(e) requires that personal data is kept in a form permitting identification of data subjects for no longer than is necessary for the purposes for which it is processed. Organisations should define retention periods for each category of personal data, documented and applied consistently. The law requires the ability to justify retention, not necessarily a prescribed period for every category — but the ICO expects proportionate, documented decision-making. Keeping data “in case it is needed” is not a compliant approach.
No universal retention periods
UK GDPR does not prescribe specific retention periods for most categories of data. Organisations must determine appropriate periods based on purpose, legal obligations, professional standards, and the consequences of retaining data too long. Some statutory obligations specify minimum periods — HMRC requires financial records for six years; MLR 2017 requires CDD records for five years from end of the client relationship. Where a statutory minimum applies, it sets the floor, not the ceiling.
Building a retention schedule
A data retention policy must contain a retention schedule mapping each category of data to a defined period, the basis for that period, and the destruction process. Common categories include: employee records (duration of employment plus relevant limitation period, with payroll records for at least six years); customer records (duration of relationship plus contract limitation period); CCTV footage (industry norm is typically 31 days, depending on purpose and justification); and unsuccessful recruitment records (typically no longer than six months).
MLR 2017 retention conflict
AML-regulated firms must retain CDD records for five years under MLR 2017 regulation 40. This conflicts with UK GDPR’s storage limitation principle. The conflict is resolved by Article 17(3)(b) — the exemption from erasure where retention is required by law. This must be documented in the retention policy and privacy notice. At the end of the five-year period, CDD data must be destroyed and the destruction recorded.