Keeping Data Safe: Exchange Storage And Retention

Whilst personal information must be destroyed when it is no longer required for the purpose for which it was provided, it is for the organisation which generated that information (the “data controller”) to make the decision about when the information should be destroyed. What happens to documentation and data may be subject to separate contractual requirements which already exist between the organisations. It is for the organisation supplying information and the organisation receiving it to make sure that each knows how the data is going to be stored and when it will be returned.

Any information relating to allegations of sexual abuse must be kept indefinitely in line with the existing requirements of the Independent Inquiry into Child Sexual Abuse (IICSA) requirements. This information must be easy to identify, should it be needed.