Accuracy and Retention

The Data Protection Act 2018 includes two rules about the quality and lifespan of personal data: it must be accurate, and it must not be kept for longer than necessary.

Accurate and up to date

Personal data must be accurate and up to date. If an organisation finds a record is wrong or out of date, it must correct or delete it quickly. Imagine an esports club runs a tournament that is only open to players aged 16 and over, so it stores each player's date of birth. If a player's birth year was typed in wrongly when they signed up, the club must put the record right as soon as it is told. Otherwise it might turn away a player who is old enough to enter, or let a younger player through.

Kept only as long as needed

Personal data must not be kept longer than it is needed. Once the purpose for holding it is finished, the organisation should review the data and then delete it or anonymise it — changed so the person can no longer be identified. For example, a mobile phone repair shop collects a customer's name and number to call them when a repair is ready. After the phone is collected, the shop might keep the details for the warranty period. Once that ends, it should review and delete them. If it wants to count how many repairs it did each month, it can anonymise the records first by removing names and numbers.

The Act prohibits keeping personal data that is wrong or out of date, and it prohibits keeping personal data that is no longer needed. Both rules apply to computer records and paper records.