Disposing of personal data

One of the Data Protection Principles requires that personal data is not kept longer than is necessary for its purpose. On the other hand, the University is required to retain certain records for operational and administrative purposes and to demonstrate compliance with statutory or regulatory requirements. Guidance on how long to keep various records can be found on the Records management pages.

When you want to dispose of disks that contain personal data, especially sensitive personal data, it is essential that the disks are disposed of in a confidential manner. Contact Facilities Management Directorate (FMD), who will supply you with details of the current arrangements for disposal of confidential waste of all types or consult the Recycling and Waste.

It is also necessary to consider the implications of disposing of computer hardware. The hard discs of computers that are to be sold on or thrown away may still contain personal data, some of which might be sensitive personal data. Contact Facilities Management Directorate (FMD) for advice.