Data & Document Retention Policy
This Policy deals with the retention of various data and documents of OSP Consulting India Private Limited (“Company”).
1. Statutory and other Records
a) Minutes and Board related documents: Minutes of meetings of the Board of Directors, Committees and shareholders shall be maintained in perpetuity. A copy of all materials provided to the Board of Directors or Committees of the Board shall be maintained for a period of one (1) year.
b) Statutory Registers and other documents pursuant to Companies Act: The Statutory Registers, filings with Registrar of Companies and other documents as required under the Companies Act 2013 shall be retained as per the requirement of the Act.
c) Books of Accounts and Tax Records: Books of accounts and Tax records should be retained for at least eight (8) years following the completion of the relevant transactions or assessment year for which the records were last used or as per the requirement of the relevant statute.
d) Employment Records: The Company maintains personnel records that include recruitment, employment, revision and personal information. These records should be retained for a period of one (1) year following the expiry or termination of employment. The employment records, which are statutory in nature shall be maintained as required under the relevant statute.
e) Intellectual Property Records: Documents relating to the development and protection of intellectual property rights should be maintained for the life of such intellectual property right.
f) Contracts: Execution copies of all contracts entered into by the Company should be retained for at least one (1) year following the expiry or termination of the contracts or as per the contractual terms.
g) Judicial Orders: Judicial orders shall be preserved permanently.
h) Other Statutory records: The other statutory records as required under various statutes shall be retained as per the requirement under the relevant statute.
2. General Data Protection Regulation (GDPR)
The Company needs to collect personal information about job applicants, the people we employ, work with or have a business relationship with to effectively and compliantly carry out our everyday business functions and activities, and to provide the services defined by our business type. This information can include but is not limited to, name, address, email address, date of birth, identification number, private and confidential information, sensitive information, and bank details.
In addition, we may occasionally be required to collect and use certain types of personal information to comply with the requirements of the law and/or regulations, however we are committed to collecting, processing, storing and destroying all information in accordance with the General Data Protection Regulation, EU data protection law and any other associated legal or regulatory body rules or codes of conduct that apply to our business and/or the information we process and store.
GUIDELINES & PROCEDURES
The Company retains data records efficiently and systematically, in a manner consistent with the GDPR requirements, ISO 9001:2015, ISO 27001: 2013 and regulatory Codes of Practice on Records Management. This policy is widely disseminated to ensure a standardised approach to data retention and records management. Records will be retained to provide information about, and evidence of the Company’s transactions, customers, employment, and activities. Retention schedules will govern the period that records will be retained and can be found in the Record Retention Periods table at the end of this document.
2.1 Retention Period Protocols
All company and employee information is retained, stored and destroyed in line with legislative and regulatory guidelines.
- Carry out periodical reviews of the data retained, checking purpose, continued validity, accuracy and requirement to retain
- Establish periodical reviews of data retained
- Establish and verify retention periods for the data, with special consideration given in the below areas:
- the requirements of the Company
- the type of personal data
- the purpose of processing
- lawful basis for processing
- the categories of data subjects
- Where it is not possible to define a statutory or legal retention period, as per the GDPR requirement, the Company will identify the criteria by which the period can be determined and provide this to the data subject on request and as part of our standard information disclosures and privacy notices
- Have processes in place to ensure that records pending audit, litigation or investigation are not destroyed or altered
2.2 Information Asset Owners
All systems and the records they contain have Information Asset Owners (IAO) throughout their lifecycle to ensure accountability and a tiered approach to data retention and destruction. Owners are assigned based on role, business area and level of access to the data required. The IAO is recorded on the Retention Register and is fully accessible to all employees. Data and records are never reviewed, removed, accessed or destroyed without the prior authorisation and knowledge of the Information Asset Owner.
2.3 Suspension of Record Disposal for Litigation or Claims
If the Company is served with any legal request for records or information, any employee becomes the subject of an audit or investigation or we are notified of the commencement of any litigation against our Company, we will suspend the disposal of any scheduled records until we are able to determine the requirement for any such records as part of a legal requirement.
2.4 Storage & Access of Records and Data
Documents are always retained in a secure location, with authorised personnel being the only ones to have access. Once the retention period has elapsed, the documents are reviewed, archived or confidentially destroyed dependant on their purpose.
2.5 Expiration of Retention Period
Once a record or data has reached its designated retention period date, the IAO should refer to the retention register for the action to be taken.
2.6 Destruction and Disposal Of Records & Data
All information of a confidential or sensitive nature on paper or electronic media must be securely destroyed when it is no longer required. This ensures compliance with the Data Protection laws and the duty of confidentiality we owe to our employees, clients and customers.
The Company is committed to the secure and safe disposal of any confidential waste and information assets in accordance with our contractual and legal obligations and that we do so in an ethical and compliant manner. We confirm that our approach and procedures comply with the laws and provisions made in the General Data Protection Regulation (GDPR) and that staff are trained and advised accordingly on the procedures and controls in place.
2.6.1 Paper Records
Due to the nature of our business, the Company retains paper based personal information and as such, has a duty to ensure that it is disposed of in a secure, confidential, and compliant manner. The Company utilises a Professional Shredding Service Provider to dispose of all paper materials.
Employee shredding machines and confidential waste disposal units are made available throughout the building and where we use service provider disposals, regular collections take place to ensure that confidential data is disposed of appropriately.
2.6.2 Electronic & IT Records and Systems
The Company uses numerous systems, computers, and technology equipment in the running of our business. From time to time, such assets must be disposed of and due to the information held on these whilst they are active, this disposal is handled in an ethical and secure manner.
The deletion of electronic records must be organised in conjunction with the IT Department who will ensure the removal of all data from the medium so that it cannot be reconstructed.
Only the IT Department can authorise the disposal of any IT equipment and they must accept and authorise such assets from the department personally. IT equipment follows a fully auditable disposal process involving a combination of secure electronic and physical destruction methods to permanently erase data records prior to disposal of the asset.
In all disposal instances, the IT Department must complete a disposal form and confirm successful deletion and destruction of each asset. This must also include a valid certificate of disposal from the service provider removing the formatted or shredded asset. Once disposal has occurred, the IT Department is responsible for liaising with the information Asset Owner and updating the Information Asset Register for the asset that has been removed.
It is the explicit responsibility of the asset owner and IT Department to ensure that all relevant data has been sufficiently removed from the IT device before requesting disposal.
2.6.3 Internal Correspondence and General Memoranda
Unless otherwise stated in this policy or the retention periods register, correspondence and internal memoranda should be retained for the same period as the document to which they pertain or support (i.e. where a memo pertains to a contract or personal file, the relevant retention period and filing should be observed).
Where correspondence or memoranda that do not pertain to any documents having already be assigned a retention period, they should be deleted or shredded once the purpose and usefulness of the content ceases.
In specific circumstances, data subjects’ have the right to request that their personal data is erased, however the Company recognise that this is not an absolute ‘right to be forgotten’. Data subjects only have a right to have personal data erased and to prevent processing if one of the below conditions applies:
- Where the personal data is no longer necessary in relation to the purpose for which it was originally collected/processed
- When the individual withdraws consent
- When the individual objects to the processing and there is no overriding legitimate interest for continuing the processing
- The personal data was unlawfully processed
- The personal data must be erased to comply with a legal obligation
SPECIAL CATEGORY DATA
In accordance with GDPR requirements, organisations are required to have and maintain appropriate policy documents and safeguarding measures for the retention and erasure of special categories of personal data and criminal convictions etc.
Our methods and measures for destroying and erasing data are noted in this policy and apply to all forms of records and personal data, as noted on our retention register schedule.
COMPLIANCE AND MONITORING
The Company are committed to ensuring the continued compliance with this policy and any associated legislation and undertake regular audits and monitoring of our records, their management, archiving and retention. Information asset owners are tasked with ensuring the continued compliance and review of records and data within their remit.
As stated above, and as required by law, the Company shall not retain any personal data for any longer than is necessary considering the purpose (s) for which that data is collected, held, and processed.
This Policy shall be subject to review as may be deemed necessary by the Board of Directors /Administrative Committee and in accordance with any Regulatory Amendments.