Data Retention and Destruction Policy

Data Retention and Destruction Policy

Pauline Tarrant Consulting

Version 1.0 — September 2026

Next review: September 2027

1. Purpose

Keeping data longer than we need it creates risk without creating value. Every record we hold is a record that could be lost, stolen, subpoenaed or misused. At the same time, destroying records we are required to keep exposes us to penalties and leaves us unable to defend ourselves if a dispute arises.

This policy sets out how long we keep information, why, and how we get rid of it properly when the time comes.

It exists to meet our obligation under Australian Privacy Principle 11.2 — that personal information no longer needed for any permitted purpose must be destroyed or de-identified — and to make sure our practice matches what we tell clients in our Privacy Policy.

2. Scope

This policy applies to all information held by Pauline Tarrant Consulting, in any format, including:

1. records in the Platform at paulinetarrant.com,
2. database backups and archives,
3. email and correspondence,
4. files held in cloud storage or on local devices,
5. paper records, and
6. data held on our behalf by third parties.

It applies to everyone who handles that information: principals, employees, contractors and anyone given access to our systems.

3. Responsibilities

4. Principles

1. Collect less. The cheapest record to protect is the one we never collected. Do not gather personal information because it might be useful one day.
2. Keep to a purpose. Every retention period in this policy traces to a legal requirement or an identified business need. "Just in case" is not a business need.
3. Destroy on schedule, not on impulse. Records are destroyed because the period has expired, not because someone wants to tidy up.
4. Destruction means destruction. A record is destroyed when it cannot be recovered by us or by anyone else, including from backups, archives and soft-delete tables.
5. Write it down. Destruction of client data, personal information or financial records is logged.
6. Legal hold overrides everything. See section 8.

5. Retention schedule

Periods run from the trigger date in the second column. Where more than one period could apply, the longest governs.

Financial and corporate

People

Recruitment and prospect data

This category carries the most privacy risk in our business, because much of it concerns people who never asked to be in our systems. It gets the shortest periods.

Client and operational

6. Destruction methods

Destruction must be appropriate to the medium and irreversible.

Paper. Cross-cut shredding, or a commercial secure destruction service that provides a certificate of destruction. Not general waste, not recycling.

Electronic records in the Platform. Deletion through the application, followed by clearance of the residual copies described in section 6.1.

Database records. Hard deletion, or de-identification where the record must be retained in aggregate but the individual no longer needs to be identifiable. De-identification must be genuine — removing a name while leaving date of birth, postcode and job title is not de-identification.

Files and documents. Deletion from the source and from any synced or cached copy, followed by emptying of the recycle bin or trash.

Storage media being retired or reused. Full-disk cryptographic erase, or overwriting to a recognised standard such as NIST SP 800-88. Physically destroy any drive that cannot be verified as wiped. Do not sell, donate or dispose of a device that has held client data without confirming this.

Third-party held data. Instruct the provider in writing to delete, and obtain confirmation.

6.1 Residual copies — the part that is usually missed

Deleting a record in the application does not necessarily destroy it. On a Frappe / ES ERP platform, several mechanisms retain data after deletion, and each must be cleared for destruction to be complete:

1. Deleted Document records. Deleting a document creates a Deleted Document entry containing the full record as JSON. The data is still on the system until that entry is removed.
2. Version history. The Version doctype stores field-level change history, which can contain values that were later deleted or corrected.
3. Communications and comments. Emails, comments and attachments linked to a record may survive the deletion of the parent record.
4. Email Queue. Outbound message content, including attachments, is retained in the queue after sending.
5. Attachments. Files stored on disk are not always removed when the linked document is deleted. Check the file store.
6. Backups. A deleted record persists in every backup taken before the deletion.

6.2 Backups

Backups are the standing exception to immediate destruction, and clients should be told so plainly.

1. Backups are retained on a rolling cycle of 7 days and 52 weeks. Define this and state it consistently in the Privacy Policy.
2. Data deleted from the live system persists in backups until the last backup containing it rolls out of the cycle.
3. We do not selectively edit backups to remove individual records. Doing so would compromise their integrity and their value in a recovery.
4. Where a person exercises a right to erasure, we delete from the live system immediately, suppress the record from being restored, and confirm that the backup copies will expire within the retention cycle.
5. Expired backup media and files are destroyed under section 6.

7. End of a client engagement

When an engagement ends:

1. Confirm in writing what the client wants done with their data — export, transfer to another provider, or deletion.
2. Provide a complete export in a usable format within 30 days of the request. Do not withhold data over a billing dispute.
3. Hold the data for a defined grace period — 90 days is the default — so the client can come back if the export proves incomplete.
4. After the grace period, destroy the client's data under section 6, retaining only what we must keep under section 5 for our own legal purposes (typically financial records and our own advice files).
5. Log the destruction and confirm to the client in writing.

8. Legal hold

If we become aware of actual or reasonably anticipated litigation, a regulatory investigation, a subpoena, an access request, or a privacy complaint, all destruction of potentially relevant records stops immediately, regardless of what the schedule says.

The Principal issues the hold in writing, identifies the records covered, and notifies everyone who might otherwise destroy them. Scheduled destruction resumes only when the Principal lifts the hold in writing.

Destroying records after a hold is on foot is a serious matter and can constitute an offence.

9. Destruction log

Every destruction event covering client data, personal information or financial records is recorded with:

1. what was destroyed, described well enough to identify it,
2. the retention rule that authorised it,
3. the date,
4. the method,
5. who carried it out and who authorised it, and
6. any certificate of destruction.

The log itself is retained for 7 years.

10. Exceptions

Departures from this policy require written approval from the Principal, recording the record affected, the reason, the new period, and a review date. Exceptions are reviewed annually and are not open-ended.

11. Review

This policy is reviewed annually, and additionally when the law changes, when we adopt a new system, or after any incident that exposes a gap.