Personal data should not be kept in a form which permits identification of data subjects for longer than is necessary for the purposes for which the personal data are processed.
There is one exception whereby personal data may be stored for longer periods insofar as the personal data will be processed solely for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes subject to implementation of the appropriate technical and organisational measures required by the GDPR in order to safeguard the rights and freedoms of the data subject.
In some cases the retention period may be determined by law, but in others it is a matter of best practice.
The College’s retention periods for different categories of records are set out in the College's Retention schedule (pdf). For further detailed advice on document retention please contact the Archives and Corporate Records Unit. Also, if you do not see any specific category of records on the Retention Schedule and you think that such category ought to also be included, please reach out to the Archives and Corporate Records Unit.