Setting and managing data retention schedules

A retention schedule specifies how long you keep personal data and what happens to it afterwards. UK GDPR requires you to keep data only for as long as necessary for the purpose it was collected.

Where to set retention periods

Retention is set in two places in Folelse: on each ROPA entry (the policy-level retention) and on each Information Asset (the operational-level retention). The Retention Schedule page (Dashboard → Retention) shows a consolidated view across all assets.

How to set retention on a ROPA entry

1. 1 Open the ROPA entry.
2. 2 Scroll to the Retention section.
3. 3 Set the Retention Period (e.g. "7 years", "3 months after last contact").
4. 4 Set the Statutory Basis — the law or policy that requires or permits this period (e.g. NHS Records Management Code of Practice 2021, Companies Act 2006, HMRC requirements).
5. 5 Set the Disposal Method — Secure Deletion, Anonymisation, Transfer to Archive, or Physical Destruction.
6. 6 Set a Retention Review Date — when you will next review whether this period is still appropriate.
7. 7 Click Save.

Retention Schedule dashboard

Go to Dashboard → Retention to see all assets sorted by urgency. Status badges indicate:

• Overdue (red) — the review date has passed. You should review and confirm the retention period is still appropriate.
• Due Soon (amber) — review date is within 30 days.
• OK (green) — review date is in the future.
• Not Set (grey) — no review date has been configured.