How Long Can Records Be Retained For?

Records Retention

Information held for longer than is necessary carries additional risk and cost. Records and information should only be retained when there is a business need to do so. Under UK GDPR and the DPA 2018, personal data processed must not be retained for longer than is necessary for its lawful purpose.

The default standard retention period for Loganair records is 6 years plus current, otherwise known as 6 years + 1. This is defined as 6 years after the last entry in a record followed by first review or destruction to be carried out in the additional current (+ 1) accounting year.

Records must only be retained beyond the default Loganair retention period if their retention can be justified for statutory, regulatory, legal or security reasons or for their historic value as defined by the relevant departmental Director. The disposal periods for records retained for extended duration must be included within line of business retention schedules. Each department is responsible for maintaining and publishing their own record retention and disposal schedules.

Retention Requirements For Personal Data

UK GDPR regulations specify that personal data shall be kept for no longer than is necessary for the purposes for which the personal data are processed. Personal data may be stored for longer periods insofar as it will be processed solely for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) of UK GDPR.

Personal data must be periodically reviewed in accordance with departmental retention schedules and if it is no longer needed it should be deleted.

Where Loganair is required to erase personal data, but the personal data must be maintained as evidence for legal purposes or for reasons of important public interest, Loganair must (instead of erasing the personal data) restrict its processing.