DATA RETENTION SCHEDULE
Legal name of the entity
Effective Date
Owner Name or role (for example DPO)
Record types 1 Basis
GDPR Art.5(1)(e) DPDP Act, 2023 s.8(7) ISO/IEC 27001 records control Personal data must be kept no longer than necessary for its purpose and then erased or anonymised. This schedule records how long each record type is kept, why, and how it is disposed of.
1. Scope and ownership
This schedule applies across Legal name of the entity and is owned by Name or role (for example DPO) . It is reviewed [cycle].
2. Retention schedule
The organisation retains 1 record type(s) as follows:
Record Category Retention period Lawful basis Disposal __GAP[records Retention entries]__ — — —
3. Disposal
At the end of the retention period, records are securely deleted or anonymised. Disposal is logged. Records under legal hold are retained until the hold is lifted.
4. Approval
Approved by Name and designation on [date].
Approved by
Name and designation
______________________
Schedule Owner
Name or role (for example DPO)
______________________