Retention, archiving and deletion

1. Regulatory Concept & Core Standards

This video focuses on how to apply retention criteria without confusing closure with erasure. Follow the sequence of decisions in the example rather than simply memorising a list. Notice who is involved, what information is needed and the expected result. These points help turn the content into a practice that another person can verify. Case files may contain information about reporting persons, witnesses and people concerned. The Polish Act and GDPR require assessment of purpose, scope and access. The course also covers retention, rights and incidents, distinguishing registers, case documentation and records in other proceedings.

A retention schedule must specify data category, applicable rule, starting event, duration and any legally permitted exceptions. Receipt, closure and communication of outcome are different events. Distinguish a statutory maximum from a minimum and an internal review date. Litigation does not automatically override a statutory maximum. Assess any separate lawful use for proceedings and the public-archive rules that actually apply.

Apply the following rule: Distinguish records and recipients. Articles 8(8), 29(5) and 46(4) provide three-year retention linked to the end of the relevant calendar year and completion of follow-up or resulting proceedings, as applicable. The Commissioner’s forwarded-report personal data and documents instead have the 12-month rule in article 8(7). Article 8(9) requires deletion/destruction on expiry, with the exception in 8(10) for documents forming part of specified investigation or court files. Clearly irrelevant personal data are deleted within 14 days after their irrelevance is established under article 8(4). Do not use receipt as the universal starting date.

2. Practical Implementation & Procedure

Define information classes, the reference event, duration, review owner and final disposition. Before a scheduled deletion, check the applicable rule, necessity and any pending proceedings. Preserve material only where legally permitted or required; do not invent an extension to a statutory maximum. Include exported copies and archival media, with restricted access. Clearly irrelevant data follow their own deletion rule. Before moving on, turn this procedure into a sequence you could explain to a colleague. Identify the first check, the action that depends on its outcome and the record that allows the decision to be reconstructed. Follow the sequence on screen and identify the point where an error would change the result.

3. Case Study & Compliance Action

Follow-up ends in November, but proceedings resulting from it continue. The organisation assesses the statutory connection with completion of proceedings instead of using receipt as the universal trigger. Now read the case carefully. Separate established facts from information you would still need to confirm. Do not add motives or events that have not been described. This distinction matters when choosing a response proportionate to the information available.

The exercise is as follows: Why is the receipt date insufficient for the entire retention schedule? Choose an answer and write one sentence explaining it. During the pause, compare your choice with the criteria we have just considered. Also think about the material you would retain to explain the decision later.

The Act distinguishes triggers and categories of records. A single fixed date can cause premature deletion or excessive retention.

One mistake to avoid is: configuring a single deletion period without legally relevant exceptions.

Now apply the national rule to a second decision. The system deletes every case five years after receipt regardless of record type and proceedings. Is that appropriate?

No. Polish law distinguishes entity data, registers, RPO forwarding and procedural files. Identify the appropriate three-year or specific twelve-month period and the relevant event and calendar-year end. Irrelevant information must not await the end of the whole case. Record the basis, deletion date and any applicable exception.