The GDPR panic may have subsided – but managing data was an important issue for businesses long before the new rules came into force in May.
Ensuring compliance should not come at the expense of neglecting much longer standing regulations that relate to the handling of important information. One of the most significant – yet often underestimated – operational considerations for businesses of all shapes and sizes is the retention of physical records.
Now is as good time a time to revisit some of the crucial records retention regulations that many businesses owners – particularly those just starting up – may not know about. Here are just a few of the most important.
Now that VAT returns are processed entirely online, it would be easy to fill them in and forget about them until next year. But your business is still required to keep comprehensive physical records.
Every company needs to hold on to physical VAT records for at least six years from the date of creation, or risk being in breach of VAT Act 1994 (Schedule 11, paragraph 6) and HMRC Notice 700/21 October 2013.
It’s up to you where you store these records, just as long as you have easy access to them for the noted period.
Business contracts and agreements
It makes sense for businesses to hold on to contracts and agreements, so they are easily accessible in case of any disputes or complaints. Having them close at hand can offer peace of mind – but it is also a legal obligation.
Business agreements, contracts and other commercial documents must be stored for a period of six years – not including the length of the contract – to be in compliance with Section 5 of the Limitation Act 1980. So, even after an agreement has been terminated, it’s important to ensure you keep a record of the full terms for the appropriate length of time.
Another area that adheres to the six-year rule is pension documentation. The Registered Pension Scheme (Provision Of Information) Regulations 2006 states that any information a business holds in relation to pension schemes requires a minimum storage time of six years.
If your company does not currently have a plan to correctly store, process, manage and destroy this data, it’s a good time to make sure everything is in place, as the intricacies are only going to get more complex over the next few years with the UK government’s auto-enrolment scheme. It may make organising your employees’ pensions easier, but it will also greatly increase your obligations in terms of the way you deal with the data.
Workplace injury reports
If you don’t work at a factory, construction site or with dangerous chemicals, you may think your workplace is a relatively safe environment. But employees can get injured anywhere – even sitting at their desks in a trendy start-up.
If and when an injury does occur it’s important to keep a record of what happened. Regulation 12 of the Reporting Injuries, Diseases and Dangerous Occurrences Regulations 2013 demands that you keep these details for a minimum period of three years, and a maximum period that is determined by general personal data regulations.
If a medical examination has taken place in relation to hazardous substances, you will need to hold on to those records for at least 40 years to comply with Regulation 10(5) of the Control of Substances Hazardous to Health Regulation 2002.
Getting records retention right
The rules surrounding data retention, processing and destruction can seem complicated. But every company needs to ensure they develop a full and comprehensive data retention policy, and it’s important that everyone in the company – from top to bottom – is informed and onboard.
The policy should include key decisions on which documents need to be stored, which need to be destroyed, and how to safely do both. It should also bear in mind who needs access to those documents and how that is managed.
If you are planning to handle the company records in house, there are decisions to be made as to whether they can be stored digitally or whether an original “hard” copy is required. Hard copies will necessitate an area dedicated to archiving that may take up much-needed office space. A sensible alternative would be to outsource these requirements to a specialist records management company.
The threat of financial penalty may be reason enough to revisit your company’s records handling, but knowing which documents you’re required to keep and ensuring they are accessible to those who need them is good business practice. Ultimately, it means more time to concentrate on moving your organisation forwards.
Paul Ravey, Sales Manager, Access Records Management