SOS Children’s Villages UK (“the Charity”)

Data Retention Policy

Last updated: 15 March 2024

Introduction

SOS Children’s Villages UK (“the Charity”), is committed to ensuring that its staff, community, operations and all affiliated parties operate to a lawful and high standard. We work to keep families together, provide alternative care when needed, support young people on their path to independence, and advocate for the rights of children. Together with donors, partners, communities, and governments, we lay the foundations for a brighter future. This is reflected in our core values of: Courage, Commitment, Trust and Accountability.

1 Purpose of this policy

1.1 One way that the Charity remains committed to its values is by ensuring that its policies and procedures remain robust. This Data Retention Policy seeks to ensure that the charity and its staff and operations, provide detailed processes as to how the charity handles and retains its data. These are outlined below:

1.2 This Data Retention Policy has been approved by the Board of Trustees (the Trustees) of SOS Children’s Villages UK.

1.3 The Data Retention Policy will enable the Charity to comply with the requirements of data protection legislation. Furthermore, this policy will enable the Charity to manage and track documents and assist in providing openness and transparency to the public.

1.4 The Data Retention Policy is required to support the organised creation, retrieval, appropriate storage and preservation of the Charity’s essential records. In addition, it is essential to support the appropriate disposal of documents with no continuing business, legal or historical significance.

• As a Charity, the actual period for records to be kept will depend on several factors, including:
• legal requirements (such as The Data Protection Act and the Independent Commissioners Office).
• storage costs.
• the Charity’s need to access the document.
• historical value.
• industry standards or best practice.
• archival needs (permanent preservation).
• decision by senior management (in the absence of guidance on the above).

2 Scope of the Policy

• This policy applies to the following:
• SOS Children’s Villages representatives: anybody representing the Charity in a paid or unpaid position. This includes staff, volunteers, trustees, consultants and contractors.
• Associates: anybody that works in collaboration or partnership with the charity. This includes member associations of the SOS Children’s Villages Federation, of which the Charity is also a member.
• This policy encompasses:
• records created by or on behalf of the Charity and staff in their duties for the Charity.
• records received by any member of staff in the Charity.
• hard copy and electronic records including Internet and Intranet sites, databases, emails, films and videos.

3 Data Protection

3.1 This policy will ensure that the Charity is complying with applicable data protection legislation (such as The Data Protection Act and the Independent Commissioners Office), which requires that we do not retain personal data for longer than is necessary.

This policy complies with the UK GDPR key principles of:

• Lawfulness, fairness and transparency
• Purpose limitation
• Data minimisation
• Accuracy
• Storage limitation
• Integrity and confidentiality (security)
• Accountability

3.2 To comply with the principles of data protection legislation, the Charity must:

• only keep information for as long as there is a business need.
• keep records secure, whether electronic or paper.
• ensure records are retrievable and easily traced.
• allow a person access to information held about them, should they request it.

3.3 It follows that the Charity must:

• destroy papers and electronic data for which there is no continuing business need and send papers that cannot be destroyed to archive for as short a time as possible.
• keep data secure while it remains in any office.
• keep track of where information is stored.
• continue to apply these good practices to avoid stockpiling papers in the future.

4 Policy

4.1 All records received on behalf of the Charity as part of its business will be its property, which may be disposed of or released as the Charity sees fit or as required by law. Originators and owners’ rights will be fully respected in accordance with relevant legislation.

4.2 All records created by or on behalf of the Charity belong to the Charity. This includes any rights or copyright in the context, except where specifically provided under copyright legislation.

4.3 Responsibility for inputting and maintaining records lies with the relevant Director of each operation as the information asset owners. Responsibility for disposing of archive records within the relevant timeframe lies with the Data Protection Officer. It is the Directors and Data Protection Officer’s responsibility to ensure that complete and accurate records are maintained and retained in line with relevant legislative requirements and agreed best practice.

4.4 Responsibility for managing and tracking records lies with the relevant Director who:

• Will determine if a file is no longer required for current business usage, which can then be added to the archive.
• May choose to retain records for longer than the indicative periods given in the retention schedule, for example, if they consider records to be of significant historical value or if the issue they are concerned remains ‘live.
• If retaining records for longer than the indicative periods in the retention schedule should also ensure that they maintain a sufficient audit trail that justifies their decision.
• Should ensure that records are maintained in an orderly fashion.

4.5 Responsibility for archiving and disposing of records lies with the Data Protection Officer who:

• Will oversee the secure storage and retrieval of archived records, ensuring they are accessible when needed while also being adequately protected against unauthorized access or loss.
• Will establish procedures for the secure and permanent disposal of records once they have reached the end of their retention period or are no longer needed for legitimate business purposes.

5 Record Keeping

5.1 Records will be reviewed against the record retention schedule on an annual basis by the Data Protection Officer. Records that are approaching or have passed their retention period and have no current requirement to retain the information (such as current or pending legal action or complaint) will be presented to their information asset owner for confirmation that disposal should be undertaken.

5.2 A record will be maintained documenting, as a minimum, the record type, name of the record, any further metadata that will enable subsequent identification of the record being disposed (e.g. date range); date of disposal, authorising officer name and role.

6 Secure Disposal

6.1 All deleted records will be disposed of in a secure manner. In the case of paper records, these will be shredded, and all information passed through confidential waste, which is then disposed of in a confidential manner. No shredded paper records will be passed through the general paper disposal process.

6.2 In relation to electronic records these will be deleted and the recycle bin emptied or by deleting and reformatting the drive of the computer the file is held on.

SOS Children’s Villages UK

RETENTION SCHEDULE