Data Retention Policy

Transcription

1 Data Retention Policy Lead officer: Mark S Thompson Date agreed: December 2013 EIA completed December 2013 Review date: December 2015 Working Table together of Contents to deliver quality homes and a better environment for all

2 1. Introduction Aims Scope Definitions Storage of Documents Other Documents to be Read in Conjunction Monitoring and Review Data Retention Tables Finance Budgets & Financial Control Finance Staff Contracts & Orders Capital Assets - Housing M&E Servicing Houses Aid & Adaptations Flat Blocks and Sheltered Housing Leaseholders EDH equipment and Buildings Health & Safety Governance Audits Insurance Rents & Rent Arrears Anti-Social Behaviour Tenancy Support Tenancy Services and Applications Marketing and Communications Equality and Diversity Performance & Quality Strategy & Policy Human Resources Meetings Business Planning Complaints, Compliments and Surveys Security Legal Advice Customer Contact & Correspondence Customer Involvement Page 2 of 25

3 1. Introduction This policy is to address the question of how long East Durham Homes (EDH) should keep information. This is important for a number of reasons: 1. storage has a cost whether it is on paper or on computer. Keeping information when it is no longer required is wasting money. 2. The fifth principle of the Data Protection Act 1998 requires that personal data processed for any purpose "shall not be kept for longer than is necessary for that purpose". 3. Some information degrades over time and will eventually lose its value e.g. report on the condition of a property or a tenant s rent arrears. 4. requests under the Data Protection Act or the Freedom of Act require EDH to disclose all information held. Holding unnecessary and potentially wrong information will increase the cost of processing such requests and could lead to requests to remove old and incorrect information. The policy had been written using external guides, examples from similar organisations and in consultation with EDH staff. 2. Aims The aim of the policy is to advice EDH staff on how they should manage the information that they hold. Its key purposes are to determine what information should be held and how long it should be held for. It also identifies who is responsible for reviewing the information EDH holds and making arrangements for appropriate disposal. 3. Scope This Policy applies to all permanent and temporary EDH employees and Board Directors. Each member of staff is responsible for ensuring that any data they store is, as far as possible, accurate and complete. Staff are also responsible for bringing to the attention of their manager when they notice incorrect or incomplete information held in EDH s records. This policy identifies what information is held by EDH. This will change over time and the Data Retention tables will need regular review and updating as the information we hold changes. Data Retention periods are set for a number of reasons. These include statutory requirements, Company policy or good practice. Legal requirements will always take precedence. Generally, statutory requirements define the minimum time that information should be kept. The Data Protection Act takes a different approach in stating that information should be kept no longer than Page 3 of 25

4 necessary. It does not however, make any specific statements on what the necessary period is. This will need to be determined by EDH based on their business need. If there is no specific guidance, the Limitation Act of 1980 is followed. This act in many cases sets a six year period after an event has occurred for keeping documents. This can be after employment ceases (for employment records and personnel charts) or the resolution date for a whistleblowing event or termination of a contract with suppliers, agents etc. The policy also considers an intermediate stage where documents that are no longer required for immediate access are stored off-site for a set period before they are disposed of. 4. Definitions Acronym Meaning ACOP Approved Code of Practice. HSE Construction (Design and Management) Regulations 2007, DCC Durham County Council DPA Data Protection Act 1998 IPD Institute of Personnel and Development NHF National Housing Federation PPE Personal Protective Equipment RIDDOR Reporting of Injuries, Diseases and Dangerous Occurrences Regulations 2013 RMS Records Management Society SMPR Statutory Maternity & Pay regulations Storage of Documents EDH holds a wide range of data on our business, our staff, our tenants and our properties. It will be held in a range of physical and computerised forms. The Data Retention tables in this policy describe what information is held, the retention period and who is responsible for review and disposal of redundant data. Archiving and deletion of s is a very effective way of communicating but without regular reviews can quickly clog up your computer and make information difficult to find. If you keep large numbers of s in your inbox it will slow your computer down. It is recommended that the following steps are followed to manage your . Immediately delete s that do not need to be kept. This would include things such as promotional messages, personal messages, messages related to setting up meetings Page 4 of 25

5 s containing reports or meeting notes should be deleted having saved the document if it is required. Please try to save documents in shared areas or on SharePoint so that there are not multiple copies of the same document. Try to avoid sending s with large attachments to many people. Put the document on SharePoint and the link Consider if you need to keep s if you are just copied in to the message. Do not unnecessarily copy people in to s. Consider if any s over a certain age are required. How often do you look back at old s? Consider if you could set a period after which all s should be deleted. Important s related to a particular business activity can be saved in the folders where all other related documents are stored. They can then be deleted from the system. If all the information related to a topic is saved on paper, print off the and save with the other documentation. Then delete the . Consider that s could be part of a Data Protection Act or Freedom of request. If we receive a request we are legally obliged to provide all details we hold. This could take a great deal of time. Note: It is a criminal offence to destroy information after a request for that information has been received. Only keep s where there is a clear business need to have a record. Disposal of When staff are planning disposal of information, they should take special care to decide if the information could contain confidential or personal information. If there is any doubt, it should be treated as confidential information and disposed of accordingly. Confidential paper information must be disposed of in the secure confidential waste bins located at Meridian Court Non-confidential paper information must be disposed of in the normal green waste bins located at Meridian Court Electronic information held on company computers or servers can be deleted. Please seek advice from the ICT team if you are unsure of the best way of disposing of confidential information Confidential information held on DVD s or CD s should be disposed of by placing the disks in the confidential waste bins. Confidential information held on portable hard drives or memory sticks should be passed to the ICT team for secure wiping. Disposal of documents stored off-site. EDH has an off-site storage facility where documents can be stored until no longer needed. The facility is managed by the Finance team who maintain a log of the stored material. At the agreed time the Finance team will make arrangements for disposal and keep a log. Staff wishing to use the facility must contact the Finance team for instructions. Confidential information must not be stored at the off-site facility. Page 5 of 25

6 Consideration when setting up a new information store Staff need to consider how to archive / delete information when they first set up a new information store. It is much harder to plan at a later date. Planning should consider the frequency of review, the duration that information is to be held and how information will be disposed of. 6. Other Documents to be Read in Conjunction EDH Data Protection Policy DCC Retention Guidelines 2012 National Housing Federation Document Retention for Housing Associations Records Management Society Retention Guidelines for Local Authorities 2003:1 7. Monitoring and Review This policy will be reviewed regularly. The next review will be in Page 6 of 25

7 8. Data Retention Tables 8.1. Finance Budgets & Financial Control Retention Period Justification Responsibility for Bank Accounts 6 years from end Statutory / EDH Finance Department of accounting period or disposal of asset recommendation Expenditures As above As above Finance Department Ledgers As above As above Finance Department Receipts and Revenue As above As above Finance Department All Financial Data (that can be audited) As above As above Finance Department 8.2. Finance Staff Retention Period Justification Responsibility for Payroll information 6 years from end Statutory / EDH Finance Department of accounting period recommendation Staff Tax information As above Statutory / EDH Finance Department recommendation Expenses forms As above Statutory / EDH recommendation Finance Department Page 7 of 25

8 Retention Period Justification Responsibility for Mileage claim forms As above Statutory / EDH Finance Department recommendation Pension information Permanent NHF recommendation Finance Department Records of proof of insurance and driving licence 7 years RMS recommendation Finance Department Statutory sick & maternity pay 3 years Statutory, DCC guidelines Finance Department 8.3. Contracts & Orders Retention Period Justification Responsibility for Tender Documentation successful tenders 6 years after end Statutory Limitations Finance Department of contract. 12 years after end of contract for contracts under seal Act NHF recommendation Refer to EDH SFI s Tender evaluation documentation As above Statutory Limitations Act RMS guidelines Finance Department Tender Documentation unsuccessful tenders 2 years after end of contract Refer to EDH SFI s Statutory Limitations Act NHF recommendation Refer to EDH SFI s Finance Department Page 8 of 25

9 Retention Period Justification Responsibility for Contracts for supply of goods or services 6 years after Statutory Limitations Finance Department completion (incl any defects liability period) Act NHF recommendation. Refer to EDH SFI s Documentation related to one-off purchases 6 years Company policy. Finance Department (purchase orders) Rental & Hire Purchase agreements Refer to EDH SFI s 6 years after expiry Statutory Limitations Act NHF recommendation. Refer to EDH SFI s Service Level Agreements with suppliers 6 years Company policy. Refer to EDH SFI s Finance Department Finance Department 8.4. Capital Assets - Housing Retention Period Justification Responsibility for Capital budget and expenditure 6 years EDH recommendation Finance Department Housing Asset register PIMSS Permanent Decent Homes Manager Housing Repairs information Orchard Permanent EDH recommendation Head of Neigh d Services R&T Decent Homes programme documents 6 years after completion EDH recommendation Decent Homes Manager Decent Homes reports 6 years EDH recommendation Decent Homes Right to Buy purchases 12 years after purchase DCC policy Manager Finance Department Page 9 of 25

10 Retention Period Justification Responsibility for Plans and drawings of properties Permanent Good practice Adaptations and Asbestos Manager Asbestos survey records for houses Permanent Good practice Adaptations and Asbestos Manager Asbestos removal records Permanent Good practice Adaptations and Asbestos Manager Void Inspection records e.g. Inspection sheets, Permanent Company policy R & M Manager handover documents, recharge info Cyclical maintenance records e.g. painting, one-off Permanent Company policy R & M Manager schemes, servicing contracts Tenant Home improvements Permanent Company policy R & M Manager R&M Invoicing Permanent Company Policy R & M Manager 8.5. M&E Servicing Houses Retention Period Justification Responsibility for Gas Safety certificates Min 3 years Gas Safety (Inst. & Repairs & Technical Use) Regulations 1998 Solid Fuel safety certificates Min 3 years Legal Repairs & Technical Building Regulations certificates Permanent Legal Repairs & Technical Electrical periodic inspections 10 years Legal Repairs & Technical Electrical minor works certificates 10 years Legal Repairs & Technical Electrical domestic installation certificates 10 years Legal Repairs & Technical Certificate of compliance 10 years Legal Repairs & Technical Benchmark Log book Permanent Legal Repairs & Technical Page 10 of 25

11 8.6. Aid & Adaptations Retention Period Justification Responsibility for Property adaptation recommendations Permanent Good practice Adaptations and Asbestos Manager Zurich stair lift / through lift inspection reports 5 years Legal Adaptations and Asbestos Manager Occupation Therapy reports (currently retain paper records and computer copy) TBC Medical records legislation Occupational Therapist 8.7. Flat Blocks and Sheltered Housing Retention Period Justification Responsibility for Fire Safety checks - Flat Block Some held on HUB Permanent Fire Brigade H&S Advisor system and some on paper records Recommendation Electrical checks - Flat Blocks & Sheltered Housing Keep latest copy Legal Facilities Officer (carried out every 5 years) only Fire Risk Assessment - Flat Blocks & Sheltered Permanent Legal H&S Advisor Housing Gas Servicing Sheltered Housing Keep only latest Legal Facilities Officer (carried out every year) copy Weekly Health & Safety checks Sheltered Permanent Legal H&S Advisor Housing Legionella checks Sheltered Housing 5 years Legionnaire s Code of Practice Facilities Officer Page 11 of 25

12 8.8. Leaseholders Retention Period Justification Responsibility for Leases and attached service charge data 12 years EDH recommendation Finance Department Leasehold property information (on Housing Management system) Permanent Cannot be removed from system Finance Department 8.9. EDH equipment and Buildings Retention Period Justification Responsibility for Legionella testing records 5 years Legionnaire s Code of Facilities Officer Practice Asbestos records EDH offices Permanent Good practice Facilities Officer PAT testing records 3 years Electrical regulations Facilities Officer Fire Alarm testing / emergency light testing / fixed 3 years Electrical regulations Facilities Officer wiring testing Gas safety certificates EDH offices 2 years ACOP Facilities Officer Fire Extinguishers EDH offices 2 years ACOP Facilities Officer Health & Safety Retention Period Justification Responsibility for Staff Health & Safety assessment (incl workstation Min 6 years after RMS guidelines HR Department assessments) - as part of employee records Health & Safety policies See Strategy & Policy section - Page 12 of 25

13 Retention Period Justification Responsibility for Issue of PPE equipment 6 years PPE Regulations 2002 H&S Advisor Staff medical records related to asbestos held as Permanent In case of litigation. HR Department part of employee records Records of client incidents Assessed on an Health & safety of staff H&S Advisor Accidents / Incidents staff If accident involves a person under 18, then record must be kept for minimum of 3 years after 21 st birthday. If asbestos exposure then minimum of 40 years with copy to GP Accidents / Incidents tenants If accident involves a person under 18, then record must be kept for minimum of 3 years after 21 st birthday. If asbestos exposure then minimum of 40 years with copy to GP individual basis Minimum of 3 years but we keep indefinitely in case of litigation. Minimum of 3 years but we keep indefinitely in case of litigation. and tenants RIDDOR RIDDOR H&S Advisor H&S Advisor Governance Retention Period Justification Responsibility for Board papers and minutes Final Permanent for final Company Policy Governance Team papers. Board papers and minutes drafts, working papers Delete when Company Policy Governance Team finalised Panel papers and minutes Final Permanent for final papers. Company Policy Governance Team Page 13 of 25

14 Retention Period Justification Responsibility for Panel papers and minutes drafts, working papers Delete when Company Policy Governance Team finalised Memorandum and Articles of Association Permanent Company Policy Governance Team Housing Management Agreement Permanent Company Policy Governance Team Board Director Appointment letters Permanent Company Policy Governance Team Board Director Records Min 6 years after RMS guidelines. Governance Team end of directorship May need to keep past 6 years where there is likelihood of litigation. Board Director Application forms (unsuccessful) 1 Year Company Policy Governance Team Board Director E&D Profile Questionnaire Until updated Company Policy Governance Team Spreadsheet of Board Director profile data relating Delete Equality Act 2010; E&D Officer to Board and Panel reports spreadsheet when report complete Public Sector equality duty Annual Return done on-line at Companies House Not kept Legal Governance Team Financial Statements 6 years Legal Governance Team Register of Interest Permanent Company Policy Governance Team Register of seal Permanent Legal Governance Team Copy of Board Director expenses claim forms 6 years after end Company Policy Governance Team of directorship Board Director training records 6 years after end Company Policy Governance Team of directorship Deed of Waiver Permanent Legal Governance Team Audits Retention Period Justification Responsibility for Page 14 of 25

15 Retention Period Justification Responsibility for Internal Audits & correspondence Keep until Good Practice Relevant Manager superseded External Audits & correspondence Keep until superseded Good Practice Relevant Manager Insurance Retention Period Justification Responsibility for Claims information. Some cases will need to stay 6 years EDH recommendation Finance Department open beyond 6 years until resolved. Policy information Permanent NHF recommendation Finance Department Employers Liability Insurance 40 years NHF recommendation Finance Department Rents & Rent Arrears Retention Period Justification Responsibility for Rent Account Orchard HMS Permanent Good Practice Tenancy Support Correspondence related to arrears Permanent Good Practice Tenancy Support Court Papers for rent arrears Permanent Good Practice Tenancy Support Housing benefit information Permanent Good Practice Tenancy Support Anti-Social Behaviour Retention Period Justification Responsibility for Page 15 of 25

16 Retention Period Justification Responsibility for ASB case material HUB Caseworks Permanent Legal ASB Team ASB case material paperwork Permanent Legal ASB Team High Level Domestic violence cases (MARAC) 1 Year Good Practice ASB Team Public Protection cases (MAPPA) TBC Legal ASB Team ASB action plan risk assessments Permanent Legal / good practice ASB Team Tenancy Support Retention Period Justification Responsibility for Furniture scheme information TBC Legal Tenancy Support Welfare Debt Advice case notes TBC Legal / good practice Tenancy Support Sustainment Service agreements and risk Permanent Legal / good practice Tenancy Support assessments Confidential safeguarding information Permanent Legal Tenancy Support Tenancy Services and Applications Retention Period Justification Responsibility for Application information and forms (paper) 5 years Company Policy Tenancy Services Application information and forms (Abritas) 7 years Tenancy Services Tenancy information (Orchard system) Permanent Cannot remove from Tenancy Services Orchard Tenant information (Orchard system) Permanent Cannot remove from Tenancy Services Orchard House file information (Document Management) Permanent Required whilst they Tenancy Services Page 16 of 25

17 Retention Period Justification Responsibility for are still tenants Customer profile information - current tenants Permanent Required whilst they E&D Manager (computer) are still tenants Customer profile information -Former tenants Permanent Still required to do analysis of former tenants E&D Manager Customer profile forms (paper) Former tenant house file information (Document Management) Destroy when input to computer systems Permanent No longer required. Still required to do analysis of former tenants Customer Services Manager Tenancy Services Estate Management information ( HUB) Permanent Tenancy Services Welfare visit info (HUB) Permanent Tenancy Services House cards Permanent Really useful at times Tenancy Services Marketing and Communications Retention Period Justification Responsibility for Mailing lists for Insight Permanent Marketing Officer Photographs featuring customers Permanent Marketing Officer Equality and Diversity Retention Period Justification Responsibility for Page 17 of 25

18 Retention Period Justification Responsibility for Spreadsheet of customer profile data relating to Delete Equality Act 2010; E&D Officer individual service uptake reports e.g. BRG and Panel reports spreadsheet when report complete Public Sector equality duty Reports on customer complaints related to E&D or Permanent Company Policy Performance & Human Rights [as part of complaints paperwork) Notes related to customer complaints related to E&D or Human Rights Equality Impact Assessments (EqIA) Notes destroyed when complaint complete Destroy when subject of EqIA is no longer required Company Policy Good Practice Quality Manager E&D Officer E&D Officer Performance & Quality Retention Period Justification Responsibility for Customer complaints computer records Permanent Company Policy Performance & Quality Manager Customer complaints working papers Discard when case resolved Company Policy Performance & Quality Manager VMS surveys Only keep latest survey Good Practice Performance & Quality Manager KPI reports 5 years DCC policy Performance & Quality Manager Housemark reports 5 years Suggestion Performance & Quality Manager Statutory returns 7 years RMS guidelines Performance & Quality Manager Page 18 of 25

19 8.21. Strategy & Policy Retention Period Justification Responsibility for Company Policies 5 years for previous versions RMS Guidelines Strategy & Policy Manager Company Strategies 5 years for previous versions RMS Guidelines Strategy & Policy Manager Human Resources Retention Period Justification Responsibility for Employee Records Min 6 years after RMS guidelines. HR Department May need to keep past 6 years where there is likelihood of litigation. Job Application successful applicants as part of Min 6 years after RMS guidelines HR Department employee records Job Application unsuccessful applicants 6 months RMS guidelines HR Department References for employees as part of employee Min 6 years after NHF recommendation HR Department records Staff profile information current staff (computer) Permanent Required whilst they are still tenants HR Department Page 19 of 25

20 Retention Period Justification Responsibility for Staff profile information - Former staff Permanent Still required to do HR Department analysis of former tenants Staff profile forms (paper) Destroy when No longer required. HR Department input to computer systems Spreadsheet of staff profile data relating to Delete Equality Act 2010; E&D Officer individual service uptake reports e.g. BRG and Panel reports spreadsheet when report complete Public Sector equality duty Staff training records as part of employee records Min 6 years after RMS guidelines HR Department Statutory training records (e.g. Gas engineer) as part of employee records CRB/DBS records as part of employee records Disciplinary information oral warning as part of employee records - Only live for the duration of the warning. Disciplinary information written warning as part of employee records - Only live for the duration of the warning. Disciplinary information final written warning as part of employee records - Only live for the duration of the warning. Grievance information proven as part of employee records Permanent to prove historical work was done by qualified person. As long as necessary Min 6 years after Min 6 years after Min 6 years after Min 6 years after Good Practice Section 122(2) of the Police Act RMS guidelines RMS guidelines RMS guidelines RMS guidelines HR Department HR Department HR Department HR Department HR Department HR Department Page 20 of 25

21 Retention Period Justification Responsibility for Grievance information unfounded as part of Min 6 years after RMS guidelines HR Department employee records Equal Opportunities claims as part of employee Min 6 years after RMS guidelines HR Department records Sickness records including Return to Work and Min 6 years after RMS guidelines HR Department Welfare meetings as part of employee records Occupational Health information as part of Min 6 years after RMS guidelines HR Department employee records Maternity / paternity records as part of employee Min 6 years after SMPR regulations HR Department records Redundancy records as part of employee records Min 6 years after IPD recommendation HR Department Annual leave records as part of employee records Min 6 years after RMS guidelines HR Department Appraisal & One-to-One meeting Managers notes Destroy when suggestion HR Department complete Appraisal & One-to-One meeting agreed copies 6 years RMS guidelines HR Department as part of employee records Trade Union agreements 10 years after IPD recommendation HR Department ceasing to be effective Trade Union consultations 20 years RMS guidelines HR Department Trade Union Meetings 10 years RMS guidelines HR Department Meetings Retention Period Justification Responsibility for Page 21 of 25

22 Retention Period Justification Responsibility for Board Meetings See Governance - Panel Meetings See Governance - Directorate Team meetings 4 years DCC policy Director Team Meetings 4 years DCC policy Team Manager External meetings organised by EDH (e.g. Housing 6 years RMS guidelines EDH lead Partnership, Resident ) External meetings not organised by EDH 3 Years RMS guidelines EDH attendee Trade union meetings See HR section Business Planning Retention Period Justification Responsibility for EDH Business Plans 6 years after plan completion RMS guidelines Performance & Quality Manager Annual Service Plans 6 years after plan RMS guidelines Departmental Head completion Annual Reports 6 years RMS guidelines Performance & Quality Manager Emergency Plans Destroy when updated Good Practice Head of Neigh d Services R&T Records of emergency plan invocation Permanent May be required for litigation Head of Neigh d Services R&T Business Continuity Plan Destroy when updated Good Practice Business Continuity Lead Record of Business Continuity Plan invocation Permanent May be required for litigation Business Continuity Lead Page 22 of 25

23 Retention Period Justification Responsibility for Public consultation information (e.g. Stock Options) 5 years after DCC guidelines Admin Manager completion Project documentation including progress and closedown reports 6 years DCC policy Project Lead Complaints, Compliments and Surveys Retention Period Justification Responsibility for Complaints Permanent Company Policy Performance Team VMS Surveys Only keep latest Good Practice Performance Team Security Retention Period Justification Responsibility for Data Protection Act subject access requests 3 years from date DCC policy ICT Manager received Freedom of requests 6 years RMS guidelines ICT Manager Records of security breaches Permanent May be required for future litigation. Consent to providing personal data to another Until no longer DPA person or organisation required ICT Manager Customer Services Manager Page 23 of 25

24 8.27. Legal Advice Legal Advice Retention Period Justification Responsibility for Retain whilst Good Practice Department that relevant received advice Customer Contact & Correspondence Retention Period Justification Responsibility for Customer Contact Records Keyfax Permanent Cannot be removed from system Customer Services Manager Customer phone call recordings 1 year DCC policy Customer Services Manager CCTV surveillance 1 month unless Common practice Facilities Manager required for evidence. General EDH correspondence 2 years DCC policy Sender of letter EDH correspondence with MP s & councillors 6 years RMS guidelines Sender of letter Internal s (See guidance in Section 5) Retain whilst required RMS guidelines Staff responsible for own correspondence with tenants (See guidance in Section 5) Retain whilst required RMS guidelines Staff responsible for own correspondence with partners / suppliers (See guidance in Section 5) Retain whilst required RMS guidelines Staff responsible for own correspondence with other parties (See guidance in Section 5) Retain whilst required RMS guidelines Staff responsible for own Page 24 of 25

25 8.29. Customer Involvement Retention Period Justification Responsibility for Resident Association files 5 years Good practice Involvement Team Hard to engage group files Permanent Good practice Involvement Team Service Review Panel records & members 5+ years Good practice Involvement Team Resident Scrutiny records 5 years Good practice Involvement Team Photos records from events Permanent Good practice Involvement Team Patch meeting records Permanent Good practice Involvement Team Active Learning for residents 3+ years Good practice Involvement Team STAR scheme Permanent Good practice Involvement Team Resident Group Incentive scheme Permanent Good practice Involvement Team Impact assessments Permanent Good practice Involvement Team General Info Permanent Good practice Involvement Team Page 25 of 25