Information should be retained only as long as it is needed for business, legal or historical purposes and a retention policy needs to be devised and applied to all information held.

You can apply many different retention periods or you can aggregate them into three categories:

• short – for example, up to two years
• medium – up to eight years
• long

Model retention schedules

The National Archives has provided advice on retention for certain groups of administrative records. However, these model retention schedules are no longer being maintained and should be used with care. All legislative retention periods should be checked against legislation.gov.uk.

There are a number of actions you should take to ensure that disposal takes place.

Decide on trigger points

A trigger point is required to action disposal. Common examples are:

• x years after the opening OR closure of a digital file/folder

• x years after the last entry for example to a spreadsheet or database

Build disposal into your digital systems where possible

You should make the process of disposal as automatic as possible by building it into the digital systems that you use. How you do this will depend on the type of system, as different systems manage disposal in different ways. It will usually involve attaching disposal metadata to information within your systems. Where it is not possible to build in disposal then you will need to manage it separately using the schedules you have compiled under Stage 2 Find out what information you have.

Keep an audit trail

It is important to keep an audit trail of what was deleted and when. Some digital systems will do this automatically for you. For others you will have to keep a record of what has been deleted separately. A schedule of the type described under Stage 2 Find out what information you have will help to demonstrate that the intention was to dispose of information at a certain point, even if it doesn’t prove exactly when the information was disposed of.

Define deletion

Delete doesn’t always mean delete in a digital world and it is often possible to recover digital records after they have been deleted. Creating a policy or statement around when you consider digital records to have been deleted from your systems will help to avoid costly recovery efforts.

All actions in managing your information should be based on an understanding of the value that information brings to your organisation.

Types of value

Information that needs to be kept by law

Certain pieces of legislation set out types of information that should be kept and how long they should be kept for, for example, the Health and Safety at Work Act. Business units within your organisation are likely to have knowledge of legislative record keeping requirements.

Information that has ongoing business value

Information of business value is that which is needed to carry out business functions or to provide evidence of a business activity. It is essential to work with business units in deciding what should be kept for business purposes. They have real expertise in this area and should know what information they need to go about their daily work and how long they need it for.

Information that has re-use value

It is also important to consider whether your information might have value from a re-use perspective and publish accordingly. For example, government is being encouraged to publish as many of its datasets as possible and the information they contain can be used by people outside the organisation in innovative ways to create new digital applications (Apps).

It is difficult to predict what people might want to use your information for but working together with, for example, FOI and Press teams and gleaning the views of those who have a particular interest in the information your organisation creates can help give an insight into the information that is most in demand.

Information that is of historical value

Information of historical value is that which reflects the ‘what, why and how’ of government and should be selected for permanent preservation at The National Archives. This will include significant policy documents, records of significant decisions, documents about notable events, persons or public issues broadly encompassing:

• The principal policies and actions of the UK central government and English and Welsh Governments
• The structures and decision-making processes in government
• The state’s interaction with the lives of its citizens
• The state’s interaction with the physical environment

Decisions about the value of information should be based on the content and context rather than on format.

Using value to make decisions

Once you understand the value of your information you can start to make sensible decisions about how to manage it. For example:

• If you have information that is of short term value you don’t want to be incurring the costs of keeping it beyond its useful life. Storage may be cheap (and that is debatable) but it is costly to maintain, preserve and provide access to that information over time.

For information of medium/long term value that is required to carry out or provide evidence of a business function or that is of historical value, you need to have the right policies, processes and systems in place to ensure that you can find, open, understand, trust and work with the information for as long as you need to.

Ensure staff understand the value of their information

You should ensure that staff across your organisation know what information they should be keeping, why and where. Some common methods of doing this are:

• Ensuring that this is part of the induction training when people join the organisation and providing refresher training, workshops and drop in sessions to ensure that people retain this knowledge
• Printed materials such as desk guides listing what information to keep, leaflets and posters
• Using information representatives within the business to promote the message and help staff to do the right thing

For more information:

www.legislation.gov.uk

Advice on retention

Appraising your records

Business requirements for managing digital information and records (PDF, 200 KB)

General hints and tips for digitisation for business use (PDF, 19 KB)

What does your organisation do?

You should start with a clear understanding of exactly what your organisation does. Pay particular attention to any core or statutory functions as these areas are likely to create/hold the most important information. Understanding the big picture will be of great help in understanding the value of your information.

What information do you have?

Finding out what information an organisation has is often referred to as an information survey or information audit. You need to work with business areas to identify what the unit does and the information that it creates, handles, receives and shares. You need to consider all types of information no matter what the format.

See more on ways of surveying your information.

Where is your information kept?

Find out what systems contain this information. Consider all digital sources, for example: Electronic Document and Records Management Systems (EDRM), Enterprise Content Management (ECM) Systems, collaboration systems, email systems, intranet, internet, case management systems, line of business systems, social media.

It is not enough to simply know what systems exist, you also need to understand:

• the lifecycle of the technology – knowing when a system is coming to the end of its useful life will help you plan for upgrades or acquisition of new systems, migration of information between as necessary
• interdependencies between systems – do any of your systems rely on other systems to function properly?

Your IT department should already have a record of this information so it is important to work closely with them on this.

This knowledge will help you make decisions about what technology you actually need to support your information.

Duplicate information

It is common for multiple copies of documents to be held within digital systems and often there is a good business reason for this. You should identify and dispose of any duplicates if they are of no business value. There are many tools that can help you to identify duplicate information including DROID  which is a free, open source piece of software that you can run over your information stores.

Documenting what you know

You should record what you have found out in a spreadsheet or database. Ensure that you have captured at least the following information, though you may want to include more:

• type of information
• information owner
• how long the information should be kept for
• disposal action such as ‘transfer to The National Archives’
• why the information should be kept, for example, legal, regulatory or other reason for the disposal period and action
• sensitivity/access restrictions
• where the information is held

There are a number of templates such as disposal schedules, information asset registers and what to keep schedules that can be used for this purpose Your organisation is likely to use all or some of these. It may be sensible to record this information in one place but you should do what works best for your business needs. The important thing is that this information is recorded and kept up to date.

See tools below for templates that you could use or adapt to your own requirements.

Keeping it up to date

This is not a on-off task – organisations change and staff move on. It is important to appoint people to own the schedules and associated processes, which will need to be reviewed regularly and kept up to date. You might decide to review annually or at the point of change, for example, an organisational or technology change.

Tools

Information Asset Register template (XLS, 0.06Mb)

DROID

The planned disposal of paper information is a normal part of government life but this is not yet fully embedded for digital information. This is in part because:

• information is spread across a range of different electronic systems both inside and outside the organisation – for example:
• Electronic Document and Records Management Systems (EDRMS)
• shared and personal drives
• collaboration systems
• databases
• email systems including email archives
• web based social media
• For many of these systems it is not possible to ‘build in’ disposal, so it has to be managed separately

As the volume of digital information grows and ages, the urgency of this situation is increasing.

Opportunities

Responsible disposal of information presents significant opportunities to your organisation in terms of:

• reducing storage and maintenance costs by separating the information that is required from your business functions
• increasing efficiency by making it easier to find and use the information you need
• supporting compliance by enabling

Risks

Keeping information for longer than is required exposes your organisation to risks around:

• cost – there are significant costs around maintaining, preserving and presenting digital information back to the user and the more information you hold the more expensive this will be. Also, not complying with legislation such as the Data Protection Act can lead to financial penalties
• efficiency – keeping too much information will impede the performance of your digital systems and make it difficult to find the information you need to carry out your business functions. It is also hard to maintain large amounts of digital information and ensure that it is complete, available and usable for as long as you need it
• reputation – not disposing of information in a responsible and timely fashion will put your organisation at risk of non-compliance, for example, of not disposing of personal information as required under the Data Protection Act or not providing information requested under the FOI Act

Further information

Business requirements (PDF)

Information legislation

Managing risk

The National Archives provides further guidance on preparing digital records for transfer on this page.

Working with CSV files in Excel

If you are transferring records using the DROID and encrypted HDD (Hard Disk Drive) route, you will need to use two tools developed by The National Archives: DROID and the CSV Validator. DROID generates a DROID CSV export, which you can then use to create the metadata CSV file, your main working document during this process. Both files behave very much like an Excel file and it will be useful for you to be a competent Excel user.

Below is a selection of videos to help you use these tools and successfully prepare your digital records for transfer.

Copying and pasting in Excel

Here is a simple tutorial on how to use ‘Copy and Paste’ in Excel to populate single fields, connected and disconnected cells in the CSV files.

Finding terms in Excel

Here is a simple tutorial on how to use ‘Find’ in Excel. This will be helpful for you to use while searching for terms and text strings in the CSV files.

Sorting in Excel

Here is a simple tutorial on how to use ‘Sort’ in Excel to analyse values in the CSV files.

Filtering in Excel

Here is a simple tutorial on how to use ‘Filter’ in Excel to analyse the CSV files.

Conditional formatting in Excel

Here is a simple tutorial on how to use ‘Conditional Formatting’ in Excel to highlight duplicate values in the CSV files.

Further guidance and forms

Redaction toolkit (PDF, 0.18 MB)
File formats for transfer to The National Archives
Populating metadata for redacted born digital records 2018 (PDF, 1 MB)
High-level guidance covering the first three levels of catalogue entries (department, division and series)

Guidance and forms for DROID and encrypted HDD transfer method:
Digital Transfer Form
Delivery form for digital records (DOC, 0.07 MB)
Template for validating metadata CSV files and generating DROID report desk instructions 2024 (PDF, 1 MB)

The National Archives receives transfers of any digital formats. For digital records we are happy to take early transfer of material prior to the 20-year rule. We have transferred early records from several Inquiries and Inquests.

Under the 20-year rule you will transfer selected, sensitivity-reviewed digital records 20 years after they are created. Until then, you must safeguard the records and actively manage their digital continuity to maintain your ability to find, open, understand and trust them over time and through change. While this page gives guidance specifically for the transfer of digital records, you can find more information on how to ensure digital continuity in our guidance on the topic.

Additional guidance is available regarding statutory obligations for transferring records under the Public Records Act.

What departments and The National Archives need to do by law

The laws of England and Wales place obligations upon departments and The National Archives for the collection, disposal and preservation of records. Departments are obliged within the Public Records Act 1958 sections 3, 4 and 5 to select, transfer, preserve and make available those records that have been defined as public records. These obligations apply to records in all formats and media, including paper and digital records.

Read the Public Records Act 1958 for more information.

You can also read about the history of the Public Records Act and the public records system today.

You can read more on gaining access to public records on our Access to public records page.

Freedom of Information Act 2000

Additionally the Freedom of Information Act 2000 (FOI) provides a legal obligation on public bodies to make official information available. Under the FOI Act this obligation extends to places of deposit. However there are exemptions within the act where the information being considered has continuing sensitivities and can legitimately not be made available.

The FOI Act also led to the creation of a code of practice, under section 46 on ‘good practice in records management’. It contains guidance on the review and transfer of public records to an archives office for permanent preservation as well as to The National Archives and local places of deposit. Additional guidance on the FOI Act can be found below:

Freedom of Information: Procedures and guidance for public records in places of deposit (PDF, 0.96Mb)

Data Protection Act 1998

The same bodies also have obligations regarding the creation, management and storage of personal information, as defined under the Data Protection Act 1998.

Constitutional Reform and Governance Act 2010

The Constitutional Reform and Governance Act 2010 (CRAG) changed the point at which records created by government departments must be transferred for permanent preservation to 20 years. The CRAG Act also changed some of the FOI exemptions in line with this reduced definition of when a record becomes a historical record.

Transition to the 20 year rule

Transfer of records in accordance with section 3(4) of the Public Records Act 1958

This first table below refers to the transfer of records to The National Archives and places of deposit in accordance with section 3(4) of the Public Records Act 1958 (Public Records Act transition order).

Please note that record categories primarily of local interest and transferring to local authority places of deposit are not within the first commencement.

*As defined in 10(2) of the Public Records Act 1958

Transitional arrangements

Expiry of Freedom of Information Act exemptions

The table below shows the expiry of certain Freedom of Information Act exemptions.

Please note that this applies to all information held by all public authorities.

**As defined in section 62(2) of the Freedom of Information Act 2000