Policy Register
Every policy type · Assets, data and classification

Records retention schedule

How long each class of record is kept, on what basis, where, and how it is destroyed when the period ends.

How the register reads it

Also calledrecords management policy, retention periods
FamilyAssets, data and classification
Document typeRecord. The regimes ask for the content, not the label; a line pasted as a standard, procedure, plan or schedule is placed here with the label noted.
Expected ownerLegal or the compliance officer.
Review cadenceAnnual (the register's default: the clauses say planned intervals and on significant change, and do not fix a period).
On the gap list whenISO 27001 or GDPR or ISO 27701 is ticked and no line resolves to it.
TemplateData retention policy.

Which standards require it, and what each expects it to contain

3 requiring clauses, 3 regimes

Shown on a register for the regimes you tick; with none ticked, ISO 27001 is applied. Requirement text drawn from a human-verified compliance corpus under licence: the corpus statement of each clause, not the instrument verbatim.

ISO/IEC 27001:2022

ISO 27001 5.33 Protection of records

Protect records from loss, destruction, falsification, unauthorized access and unauthorized release.

What the ISO 27002 guidance expects the document to say: Requires records to be protected against loss, destruction, falsification, unauthorised access and unauthorised release.

Evidence an auditor accepts: The records retention schedule, showing retention periods and their legal or business basis per record type; evidence of protection appropriate to each record type against loss, destruction, falsification and unauthorised access or release; controls over the storage medium including its readability over the retention period
Common gap: retention schedules not aligned with legal requirements
Source: ISO/IEC 27001:2022; guidance ISO/IEC 27002:2022

ISO/IEC 27701:2025

ISO 27701 A.1.4.8 Retention

The organization must not retain personal data longer than the purposes for which it is processed require, developing and maintaining retention schedules that take account of legal, regulatory and business requirements and, where those requirements conflict, taking and documenting a business decision based on a risk assessment and recording it in the appropriate schedule.

Evidence an auditor accepts: Retention schedule covering every category of personal data, with the period and its justification; evidence the schedule is enforced, not merely published; documented risk based decisions where legal, regulatory and business requirements conflicted
Common gap: Schedule published and never enforced, so the actual retention is indefinite
Source: ISO/IEC 27701:2025

GDPR (Regulation (EU) 2016/679)

GDPR Art. 5 Principles relating to processing of personal data

Process personal data lawfully, fairly and in a transparent manner; collect it for specified, explicit and legitimate purposes and do not process it further in a way incompatible with those purposes; keep it adequate, relevant and limited to what the purpose needs; keep it accurate and up to date, erasing or rectifying inaccurate data without delay; keep it in a form permitting identification no longer than the purpose requires; and secure it against unauthorised or unlawful processing and against accidental loss, destruction or damage using appropriate technical or organisational measures. The controller is responsible for all six principles and must be able to demonstrate compliance with them.

Evidence an auditor accepts: The purpose recorded for each processing activity, stated specifically enough that a later use can be tested against it; retention schedule per data category with the criteria that set each period, and deletion evidence showing the schedule actually runs; minimisation analysis per collection point showing why each field is necessary for the stated purpose
Common gap: Purposes written so broadly, for example business purposes or service improvement, that no later use could ever be incompatible with them
Source: GDPR (Regulation (EU) 2016/679)

Do this for every document on your list

Paste the list and get this reading for every document at once, with the owner and cadence against each, the clauses quoted, and the documents the regimes expect that the list does not carry. Eight documents free, no account.

Build a register

Media handling and disposal policy · Software asset management policy