A policy for retaining personal data for no longer than needed, when you do not have a valid purpose for processing, can often be a challenge to implement.
But recently the ICO issued a charity £18,000 for shredding ‘irreplaceable’ records relating to adoptions in Scotland, to make space in filing cabinets.
BBC Tech has a report on this story at https://www.bbc.co.uk/news/articles/cj4wn00pz48o but it raises an important question for us all.
Do our retention policies help us keep personal data for as long as we have a valid purpose for processing, or may we be deleting it too soon, as well as too late?