Policy implementation

Records and documents must be proactively and consistently managed throughout their lifecycle, from their creation or receipt, through active use, on-going maintenance, storage and occasional reference to a final controlled disposal decision and action. At no point in this lifecycle should records or documents be allowed to become effectively ‘orphaned’, mislaid or lost.

It is therefore the express intention of this policy that all stages of the lifecycle should be used as points of proactive intervention to assure the on-going and consistent management of records and documents.

The objectives of this policy are articulated and supported through a number of guidance procedures. These provide essential guidance to staff on all aspects of the management and control of documents and records. They should be followed by NHS Digital staff, at whatever level, working in or on behalf of NHS Digital.

The traditional approach to retention and disposal policy (including retention schedules) has been granular; a detailed list of record and document types, each allocated a specific retention period and disposal action based on legal or regulatory requirements; business best practice guidance and the operational requirements of the business concerned.

The records management profession and organisations have developed and now adopted a new approach; in which records and documents are aggregated into a few broad categories with each category allocated a standard default retention period. A variation on this approach is known as ‘Retention by Exception’, where records and documents are allocated one of a very few standard default retention periods unless a longer or shorter exception is identified, agreed and applied. A number of large organisations have adopted similar approaches:

Department of Health

HM Revenues and Customs

It is apparent that NHS Digital, as with other organisations, would significantly benefit from an improved and more consistent approach to retention and disposal management and control. It is for this reason this policy advocates the adoption of a new approach centred on default standard retention periods whilst remaining in line with compliance obligations and best practice requirements.

Standard business administration (short retention) 3 years

This retention period must be applied to records and documents where the business importance is limited and existent for a short period only. (see Corporate Retention and Disposal Framework: Implementation Process). Such records and documents will only be retained for 3 years and then deleted or destroyed (paper hard copy and electronic storage devices) as confidential waste using NHS Digital confidential waste bins or approved electronic destruction processes.

Where such a disposal action is applied to a larger grouping or series of related records or documents over a period of months or even years, a record of the decision and disposal action must be maintained. The retention and disposal implementation processes must be followed to ensure this. (see Corporate Retention and Disposal Framework: Implementation Process).

Operational business (medium retention) 8 years

This must be applied to records and documents where the operational business importance is determined by compliance requirements such as legislation, regulation, best practice guidance or clear business rationale (see Corporate Retention and Disposal Framework: Implementation Process). These records and documents (electronic or paper hard copy) must be retained for 8 years. A record of any action in relation to these records or documents must be maintained corporately; the records management function must therefore be informed.

The retention and disposal processes must be followed in respect of records and documents with an 8-year retention period in order to ensure their proper control and management. (see Corporate Retention and Disposal Framework: Implementation Process).

Corporate significance; historic or research (long retention) 20 years

This must be applied to records and documents that contain or convey significant / key corporate decisions and actions, and that in the course of time may or will exhibit longer term historical or research importance. Such records and documents (electronic or paper hard copy) will be subject to a permanence review by the records management
function at 15 years and will be retained for 20 years (see Corporate Retention and Disposal Framework: Implementation Process). At 20 years a decision will be made to determine whether they should be offered to The National Archives or other approved place of deposit or can be deleted or destroyed as confidential waste. A record of any action in relation to these records or documents must be maintained corporately; the records management function must therefore be informed.

The retention and disposal processes must be followed in respect of the control and management of records and
documents with a 20-year retention period. (see Corporate Retention and Disposal Framework: Implementation Process).

This Policy and the new Records Management Guide 4 Corporate Retention and Disposal Framework: Implementation Process also allows for the identification and agreement of exceptions (shorter or longer) to the three default retention periods. Such exceptions must demonstrate proper rationale and ensure compliance with legislative and regulatory obligations, best practice standards and operational business requirements. 

The Retention and Disposal objectives of this Policy are implemented through the following
processes:

• maintenance of a Corporate Schedule of retention periods and disposal actions including any identified and agreed exceptions (longer or shorter) to the default standard retention periods (see Corporate Retention and Disposal Framework: Implementation Process)
• identification and agreement of retention exceptions (shorter or longer) to the default standard retention periods (see Corporate Retention and Disposal Framework: Implementation Process)
• destruction / deletion authorisation, recording and audit trails (see Corporate Retention and Disposal Framework: Implementation Process).

All staff working for or on behalf of NHS Digital must familiarise themselves with these supporting processes before implementing the records retention and disposal intentions of this policy.