Purpose
This policy sets out how Find A Way: Psychological Services CIC (company number 15992869) retains, reviews and securely disposes of personal data in accordance with:
- UK GDPR (Article 5, the storage limitation principle)
- Data Protection Act 2018
- Safeguarding best practice
- HMRC requirements
As the organisation processes special category data (health, SEND and safeguarding information), enhanced retention safeguards apply.
Our privacy policy explains how we collect and use personal information, and the rights you have over it.
Core principles
Find A Way will:
- Retain data only for as long as necessary
- Not retain information “just in case”
- Retain information only for lawful and defensible purposes
- Restrict access to the information it retains
- Securely destroy information when retention periods expire
- Conduct annual retention reviews
Retention decisions are informed by:
- Limitation Act 1980
- Safeguarding statutory guidance
- Contractual obligations
- Insurance requirements
- Funding conditions
Retention periods
These retention periods are working organisational defaults, not universal statutory requirements.
- Client case files – adults
- Six years after the case closes
- Client case files – children
- Until the child is 25, or six years after the case closes, whichever is later
- Safeguarding records
Until the person is 25, or seven years after our last contact
Where serious safeguarding issues arise, legal advice may justify extended retention.
- Video recordings (VIG)
- Full recordings are retained only until editing is complete.
- Original recordings are permanently deleted once the selected clips are prepared.
- Edited clips are provided to the family. Copies supplied to families are theirs to retain.
- All organisational copies of the selected clips are deleted at the end of the intervention or the agreed supervision purpose, subject to lawful exceptions.
- No archived copies are retained.
- Case notes and consent records are distinguished from VIG footage.
- Staff and volunteer records
- Six years after leaving
- Financial records
- Six years, as HMRC requires
At case closure, we identify the relevant category and record any reason to retain information for longer, including safeguarding, professional indemnity, complaints, litigation holds or contractual requirements. Where a child’s case file and a safeguarding record overlap, we apply the longer justified period and review it.
Secure disposal
Digital data is permanently deleted from secure systems, and backups are securely destroyed according to our documented retention design. Paper records are cross-cut shredded. Destruction is documented where appropriate, through an auditable deletion process.
Review
This policy and its retention schedule are reviewed annually by the director responsible for data protection.
The policy is published on the Find A Way website, and our privacy policy summarises its schedule. This version was last updated on 4 November 2026.