1. Introduction

1.1.
Church of Scotland congregations gather personal information from individuals and external organisations as well as generating a wide range of personal data, all of which is recorded in documents and records, both in hard copy and electronic form.

1.2.
Examples of the types of information accumulated and generated are set out in Appendix 1 of this policy and include but are not limited to minutes of Kirk Session meetings; membership rolls; baptismal information; employment records; newsletters and other communications such as letters and emails.

1.3.
In certain circumstances it will be necessary to retain documents to meet legal requirements and for operational needs. Document retention is also required to evidence agreements or events and to preserve information.

1.4.
It is however not practical or appropriate for congregations to retain all records. Additionally, data protection principles require information to be as up to date and accurate as possible. It is therefore important that congregations have in place systems for the timely and secure disposal of documents that are no longer required.

1.5.
This Data Retention Policy was adopted by the Congregation on 28th May 2019 and will be implemented on a day to day basis.

2. Roles and Responsibilities

2.1.
Congregational office bearers and those involved with safeguarding will adopt the retention and disposal guidance at Appendix 1 of this policy and strive to keep records up to date.

2.2.
Advice will be obtained from the Law Department or Safeguarding Department of the Church Office at 121 George Street if there is uncertainty about retention periods.

3. Retention and Disposal Policy

3.1.
Decisions relating to the retention and disposal of data should be guided by:-

3.1.1.
Appendix 1 – Document Retention Schedule – Guidance on the recommended and statutory minimum retention periods for specific types of documents and records.

3.1.2.
Appendix 2 – Quick Guide to document retention.

(The above appendices can be had on request from the Congregational Data Protection Officer, Graham Ritchie (geritchie@sky.com)

3.2.
In circumstances where the retention period for a specific document or category of documents has expired, a review should be carried out prior to disposal and consideration should be given to the method of disposal.

4. Disposal

4.1.
Documents containing confidential or personal information should be disposed of either by shredding or by using confidential waste bins or sacks. Such documentation is likely to include financial details, contact lists with names and addresses and pastoral information.

4.2.
Documents other than those containing confidential or personal information may be disposed of by recycling or binning.

4.3.
Electronic communications including email, Facebook pages, twitter accounts etc and all information stored digitally should also be reviewed and if no longer required, closed and/or deleted so as to be put beyond use. This should not be done simply by archiving, which is not the same as deletion. It will often be sufficient simply to delete the information, with no intention of ever using or accessing it again, despite the fact that it may still exist in the electronic ether. Information will be deemed to be put beyond use if the Congregation is not able, or will not attempt, to use it to inform any decision in respect of any individual or in a manner that affects the individual in any way and does not give any other organisation access to it.

4.4.
Deletion can also be effected by using one of the following methods of disposal:-

• Using secure deletion software which can overwrite data;
• Using the function of “restore to factory settings” (where information is not stored in a removeable format);
• Sending the device to a specialist who will securely delete the data