Thursday, April 18, 2019

Retaining documents on a website

We have come across a few instances recently where documents were retained for too long on a website.  With uploading documents to a website being used more frequently, we feel it is useful to remind you of the statutory requirements about how long the documents should remain on the website.  This is important to remember as GDPR now has an impact.  

The same retention period under rule 1.51 applies whether you are uploading a specific document under rule 1.49, or using a website to communicate generally under rule 1.50. Rule 1.51(2) provides that “such a document must continue to be made available on the website until two months after the end of the particular insolvency proceedings or the release of the last person to hold office as the office-holder in those proceedings”.

It is highly likely that the information on the website will contain personal data.  Since you can only retain personal data for as long as you have a lawful basis for holding it, then once the timescale set by rule 1.51(2) has passed, you can no longer hold any personal data on the website.  With this in mind it is important to ensure that you have a system in place to delete the documents as soon as the two month period has expired, because failure to do would result in a GDPR breach if any personal data was on the website.  

You should still retain a hard copy of the documents on your case files for 6 years to comply with your obligations under regulation 13 of the Insolvency Practitioner Regulations 2005.