Data retention in 2026 and the gap between policy and practice – article published in Privacy and Data Protection Journal

The Privacy and Data Protection Journal has published an article by Duc Tran (Of Counsel) of our Digital TMT, Sourcing & Data team. Please click here to access the full article.

The article examines why many organisations continue to struggle with data and record retention, and how they can adopt a defensible, practical approach across modern data environments. In particular, it considers:

• The legal framework - including the tension between data minimisation and the patchwork of minimum retention periods applicable to different records;
• The consequences of getting it wrong - whether through premature deletion, over-retention or failing to establish an effective governance framework;
• Common practical pitfalls in retention exercises - at both the policy drafting and the implementation stage where policy and practice can diverge, especially when records sit across email, shared drives and collaboration platforms; and
• Practical recommendations for an effective retention policy - spanning the full lifecycle, from mapping to implementation to ongoing review and auditing.

As the article explains, a well-drafted retention policy is only the starting point. Retention needs to be treated as an ongoing operational discipline, with policies designed around how information is actually created, shared and stored, rather than simply where it is supposed to be.