Retention Policy

Introduction

This policy sets out how Records / Documents will be stored, managed, and protected. It will also set out how long employment, recruitment-related information will normally be held by us and when that information will be confidentially destroyed.

It assesses the risks to Records management and how the risks are managed. This policy sets out The Recruitment Groups plans for the next 6 years regarding Records Management.

Responsibility

Compliance is responsible for implementing and monitoring this policy. Branch Managers are responsible for day-to-day Records management for their office or departments as directed by Compliance.

Compliance will undertake an annual review of this policy to verify that it is in effective operation.

Compliance will deliver training on this policy for all new internal employees as part of the induction process.

All current and existing staff members will be made aware of this policy and how to effectively implement the policy and ensure compliance with Records Management and Retention.

Our process and Risk Management

Information (hard copies and electronic) will be retained for the period specified in our Records Retention Schedule.

Hard and electronic Records will be stored securely in line with ICO recommendations and GDPR guidelines.

All electronic records including emails, files are stored securely on company laptops and our servers. This data is protected by multi factor authentication, randomly created passwords (which are a minimum of 8 characters), anti-malware software, security firewalls on our servers, computers, and laptops. Our data security is managed by an outsourced IT company, and they complete regular checks and security updates where necessary. Our security complies with the Cyber Essentials scheme, and we have a certificate of assurance to demonstrate the strength of our data security.

Any records that are stored as physical/hard copies are kept securely away from members of the public and stored securely.

When a candidate no longer requires our work finding services, all hard copies of their contact data are stored securely for the period of retention. The records are stored for the required time as mentioned in the Retention Policy below.

To be able to keep hard copies of records secure after working hours, all our offices are locked and have alarms fitted.

This Policy assess the risks associated with Records Management and how The Recruitment Group aim to minimise and control these risks.

The Recruitment Group Acknowledges that there are risks associated with storing data electronically and physically. There is a risk that both hard copies and electronic copies can be lost during an emergency or crisis. If this was to happen, we would follow the necessary steps set out in the company’s Business Continuity Plan. All electronic data is Backed-up to a remote server in the event of a crisis. If data is lost from the current CRM or server, it can therefore be recovered.

There is no back up for the paper/hard copies of records that are kept in branches. If this data is lost in an emergency there would be no way to recover the information.

There is a greater risk of keeping hard copies of records compared to storing them electronically. The Recruitment group is committed to managing this risk by removing all hard copies/physical records from our offices and to only store them electronically on the CRM and server. All branches are asked to place documents into the confidential shredding bins at branch.

All information must be reviewed before destruction to determine whether there are special factors that mean destruction should be delayed, such as potential litigation, complaints, or grievances.

Hard copy and electronically held documents and information must be deleted at the end of the retention period unless there is a requirement to delay deletion.

Hard copy documents and information must be disposed of by placing into confidential shredding bins.

Records Retention Schedule

This Record Retention Schedule sets out the time periods that different types of records must be retained for business and legal purposes.

The retention periods are based on business needs and legal requirements and should be read in accordance with The Recruitment Group’s data protection policy. If you maintain any types of records that are not listed in this schedule and it is not clear what retention period should apply, please contact compliance for guidance.

Any deviance from the retention periods in this schedule must be approved in advance by the Group Managing Director of the business.

The first section of this policy will address employment records, the second section will address work-seeker records.

Internal employee/applicants for internal roles

Work-seeker records

Payroll and salary records