Data Retention Policy
Version 1.1 | Last modified 14th February 2024
This is the Data Retention Policy of the British Academy. The British Academy is a registered charity in England and Wales (charity number 233176). It has one wholly-owned trading subsidiary (Clio Enterprises Limited, company number 07595846). The registered address of the British Academy and its subsidiary is 10-11 Carlton House Terrace, London, SW1Y 5AH.
The purpose of this policy is to specify the British Academy’s guidelines and policies for retaining different types of data and for how long.
‘We’ means The British Academy and Clio Enterprises Limited
‘ICO’ is the Information Commissioner’s Office, the body responsible for enforcing data protection legislation within the UK and the regulatory authority for the purposes of the GDPR
‘Personal data’ means any information about an identified or identifiable person. Some categories of personal data are recognised as being particularly sensitive (“special category data”).
‘Processing’ means all aspects of handling personal data, for example collecting, recording, keeping, storing, sharing, archiving, deleting and destroying it.
‘Data Controller’ means anyone (a person, people, public authority, agency or any other body) which, on its own or with others, decides the purposes and methods of processing personal data. We are a data controller insofar as we process personal data in the ways described in this policy.
‘Data processor’ means anyone who processes personal data under the data controller’s instructions, for example a service provider. We act as a data processor in certain circumstances.
‘Subject Access Request’ is a request for personal data that an organisation may hold about an individual. This request can be extended to include the deletion, rectification and restriction of processing.
This policy meets the requirements of the UK General Data Protection Regulations (UK GDPR) and the provisions of the Data Protection Act 2018 (DPA 2018). It is based on guidance published by the Information Commissioner’s Office (ICO) on storage limitation.
This policy upholds the requirement that personal data is kept in a form that permits identification of data subjects for no longer than is necessary for the purposes for which the personal data is processed. As part of this requirement the British Academy:
- Continually assesses the data held and why it is needed
- Carefully considers how long personal data is kept
- Regularly reviews and erases or anonymises personal data when it is no longer needed
- Has processes in place to comply with requests for erasure under ‘the right to be forgotten’
- Identifies any personal data that needs to be kept for public interest archiving, scientific or historical research, or statistical purposes
This policy covers all data in the possession or control of the British Academy, regardless of the medium in or on which those data are held. Where statute or regulation departs from the requirements of this policy, the British Academy will comply with the relevant statute or regulation. This policy may be updated from time to time.
The UK GDPR does not specify time limits for different types of data and allows organisations to set appropriate retention periods based on the purposes for processing. The tables in the Data retention schedule below are intended to establish standard retention periods for different categories of personal data. There may be cause for discretion where, for example, early deletion is possible as the data is no longer needed, or it is deemed necessary to keep the data for longer due to a risk of litigation or a request from an outside body.
Where personal data is processed using the lawful basis of legitimate interest or consent, the data subject has a number of rights that they can exercise over this data, such as delete or rectify. Communications with these data subjects will need to clearly sign post them to their ability to withdraw this consent or challenge the legitimate interest that has been assessed, this is commonly known as ‘opt out’. Where appropriate, the data subject should be informed every 2 years of the consent or legitimate interest being used to process their data with an option to update this preference. A formal retention period for data processing based on consent has not been defined in this policy and is assumed as permanent until the data subject exercises their rights to cease the processing activity. Examples of processing covered by this statement are subscribers to newsletters, photograph consents and marketing communications.
Where data is no longer needed, it will be anonymised or securely destroyed. This applies to paper records, electronic information and biometric information. For example, we will shred or incinerate paper-based records, and overwrite or delete electronic files. We may also use a third party to safely dispose of records on the British Academy’s behalf. If we do so, we will require the third party to provide sufficient guarantees that it complies with data protection law.
The following retention periods are established into the categories of data subject types held within the British Academy, these are as follows:
Fellows
Early Career Research Network (ECR) members
Supporters and donors
Event registrants’ and participants data
Customers and visitors
Trustees and members of the governance structure
Employees (past, present and future)
Archives
Grant applicants and recipients
Public/newsletters
Allied Organisation contacts (individuals at organisations that interact with the British Academy, either through that organisational alliance or as individuals in their own right)
The retention period is applicable at the point where the relationship has finished, for example where a customer’s service has been provided.
Fellows' data
| Data Process | Data Type | Retention | Justification |
|---|---|---|---|
| Nominations data | Personal data | 4 years post first nomination (nomination and proposal form retained in the British Academy Archive in perpetuity to retain the institutional memory of the Academy) | To aid nomination review process |
| Candidate assessments (overseas scholars) | Personal data | 5 years post first nomination | To aid nomination review process |
| Nomination references | Personal data | 4 years post first nomination | To aid nomination review process |
| Fellow membership record | Personal data and Sensitive data (special category including EDI) | *Held for the lifetime of the Fellow, transferred to the Archive on the death of the Fellow or leaving the Academy to retain the institutional memory of the Academy | To maintain their membership as a Fellow of the British Academy |
*Where the British Academy is informed of a deceased Fellow, or any other individual it interacts with, any operational personal data will be deleted where appropriate. Where the individual’s data or work is categorised as archivable, it will be retained in line with the Archive section of this policy.
Early Career Research Network (ECR) members
| Data Process | Data Type | Retention | Justification |
|---|---|---|---|
| ECR membership record | Personal data | Records removed immediately after they leave the network | Detail no longer required |
| Case studies | Personal data | 1 Year from publish | To keep data fresh |
Supporters and donors
| Data Process | Data Type | Retention | Justification |
|---|---|---|---|
| Individual Givers | Personal Data |
Fellows - indefinitely Award-holder donors - 6 years after last donation General giver – 3 Years post last interaction |
Details retained on individuals to maintain a relationship with them and inform analytics Fellows - archival reasons to record membership. Archive contact details after they are deceased. |
| Individual Givers | Financial Transactions | 6 years after the end of the year or accounting period that includes the last donation | HMRC Tax Audit |
| Individual Givers | Gift aid declaration | 6 years after the end of the year or accounting period that includes the last donation | HMRC Tax Audit |
| Individual Givers | Direct debit mandate | 6 years after the end of the year or accounting period that includes the last Direct Debit | As proof of Direct Debit Instruction (DDI) and to assist in claims against that DDI |
| Major donor record | Personal Data (including contact meetings minutes) | 6 Years – post last interaction |
Details retained on individuals to maintain a relationship with them and inform analytics To match donor’s philanthropic interests with funding opportunities at the BA In accordance with the Fundraising Code of Practice |
| Major donor research | Personal data – from public sources |
6 years after the completion of the most up-to -date research profile (if the prospect/donor is still active) 6 months if prospect/donor is no longer active or maintains relationship. Acceptance of funds – 7 years |
As proof of relationship and due diligence research/records to be presented to the Acceptance of Funds Group |
| Legacy donor | Personal data | In perpetuity | To maintain record of the legacy gift and any instructions in the Will itself |
Event registrants and participants
| Data Process | Data Type | Retention | Justification |
|---|---|---|---|
| Ad-hoc events | Personal and Sensitive data (special category including accessibility, dietary and allergy details) | 5 years post last interaction with individual | To maintain a record of them and their interactions with the British Academy to answer any queries or concerns |
| Annual events | Personal and Sensitive data (special category including accessibility, dietary and allergy details) | 18 months after event for personal data, 2 months after event for sensitive data (special category) | |
| Event Permits and licenses | Personal data | 6 months after the permit expires | To retain a record of permits and licenses held |
| Event speakers | Personal data, may include bios | 5 years post last interaction with individual | To maintain a record of them and their interactions with the British Academy to answer any queries or concerns |
Customers and visitors
| Data Process | Data Type | Retention | Justification |
|---|---|---|---|
| Carlton House Terrace attendee record | Personal data | 18 months after last booking | Required for enquiries on purchases |
| Carlton House Terrace attendee record | Transaction data | 6 Years after the end of the tax year for that purchase (7 years) | HMRC Tax Audit |
| Prospect customers – enquiries | Personal data | 2 years post last interaction with individual | To maintain a record of them and their interactions with the British Academy to answer any queries or concerns |
| Carlton House Terrace attendee accident record | Personal and Sensitive data (special category including health conditions) | 3 years post the incident (3 years post turning 18 of any young people) | In alignment with HSE requirements and RIDDOR |
| Premises visitors, including staff | Personal data | 2 months post last entry | To retain access logs for health and safety and crime prevention |
Archives*
| Data Process | Data Type | Retention | Justification |
|---|---|---|---|
| Heritage Collection (includes business archive) | Personal data | Permanent | Required for historical, research and statistical purposes |
| Donor (entry and accession) records/registers | Personal data | Permanent | Required for historical, research and statistical purposes |
| Information gathered as a result of an enquiry | Personal data | 2 years after enquiry is complete | Required to check for repeat enquiries |
| Object Exit Files and register | Personal data | Permanent | Required for historical, research and statistical purposes |
| Loan In and Out files | Personal data | Permanent | Required for historical, research and statistical purposes |
*Any documents (in digital or physical form) or artefacts that may hold value as an institutional memory or assist the British Academy in demonstrating governance and policy should be reviewed for archive storage. Where a department is not sure if this is the case for any documents or artefacts, they should inform the British Academy Archivist.
Trustees and members of the governance structure
| Data Process | Data Type | Retention | Justification |
|---|---|---|---|
| Trustee record | Personal data | 5 years post last interaction with individual | To maintain a record of them and their interactions with the British Academy to answer any queries or concerns |
Employees (past, present and future)
| Data Process | Data Type | Retention | Justification |
|---|---|---|---|
| Income tax and NI records | Personal data | 3 years from the end of financial year to which they relate | The Income Tax (Employments) Regulations 1993 (SI 1993/744) as amended, for example by The Income Tax (Employments) (Amendment No. 6) Regulations 1996 (SI 1996/2631) |
| Payroll wage/salary records (also overtime, bonuses, expenses) | Personal data | 6 years from the end of the tax year to which they relate | Taxes Management Act 1970 |
| Retirement Benefits Schemes – records of notifiable events, for example, relating to incapacity | Personal data | 6 years from the end of the scheme year in which the event took place | The Retirement Benefits Schemes (Information Powers) Regulations 1995 (SI 1995/3103) |
| Statutory Maternity Pay records, calculations, certificates (Mat B1s) or other medical evidence | Personal data | 3 years after the end of the tax year in which the maternity period ends | The Statutory Maternity Pay (General) Regulations 1986 (SI 1986/1960) as amended |
| Working time records | Personal data | 2 years from date on which they were made | The Working Time Regulations 1998 (SI 1998/1833) |
| Personnel records | Personal and Sensitive data (special category) | 6 years after the employee has left | To defend against tribunals or county or high court claim |
| Employee training records | Personal and Sensitive data (special category) | 6 years after the employee has left | Health and safety, fire precaution regulations |
| Recruitment records | Personal data | 6 months after the candidate has not been successful | To defend against tribunals or county or high court claim |
| Emails and personal data volumes | Personal and Sensitive data (special category) | 6 months after the employee has left | To answer queries that are contained in these data sources |
Grant applicants and recipients
| Data Process | Data Type | Retention | Justification |
|---|---|---|---|
| Recipient record | Personal data |
5 Years for unsuccessful applicants 10 years post last interaction with successful applicants |
To maintain a record of them and their interactions with the British Academy to answer any queries or concerns |
| Grant application | Personal data |
5 Years for unsuccessful applicants 10 years post last interaction with successful applicants |
To maintain a record of them and their interactions with the British Academy to answer any queries or concerns |
| Financial transactions | Transaction data | 6 Years after the end of the tax year for that purchase (7 years) | HMRC Tax Audit |
Public/newsletters
| Data Process | Data Type | Retention | Justification |
|---|---|---|---|
| Personal record in CRM | Personal data | 5 years post last interaction with individual | To maintain a record of them and their interactions with the British Academy to answer any queries or concerns |
Allied organisation contacts
| Data Process | Data Type | Retention | Justification |
|---|---|---|---|
| Contact record | Personal data | 5 years post last interaction with individual | To maintain a record of them and their interactions with the British Academy to answer any queries or concerns |