The HSE National Records Retention Policy provides guidance on how to manage records, including how long to keep each type or category of record. This policy replaces earlier versions. In revising this policy, the HSE acknowledges its responsibility to adhere to the GDPR 'storage limitation' principle.
All HSE employees are responsible for:
You must manage records in accordance with the HSE's retention periods outlined in the policy, and any relevant laws or regulations.
Our responsibilities for managing HSE records in accordance with this policy includes old files in locations that might not be in use.
The policy sets out the management of retention periods that consider the HSE's clinical, operational, business, and legal requirements.
A record, as defined in this policy, is any type of documentation containing information about a past event. Examples of records (page 6).
Data is individual pieces of information. Records are made up of information and data.
See list of records and their definitions covered in this policy in Appendix 1 (page 13).
The length of time to keep records varies according to the type of data or record, and the reason for keeping it.
The reason for keeping information could be clinical, business, legal, statutory, or operational.
In accordance with the GDPR principle of 'storage limitation', you should only keep data for as long as it is required.
Ensuring that records are destroyed when no longer needed reduces the risk of information becoming irrelevant, excessive, inaccurate, or out of date.
Retaining records beyond the required period increases the risk of a data breach.
The retention period of records containing personal information must be recorded in that service’s Record of Processing Activity (ROPA). This is a legal requirement under Article 30 of the GDPR.
Each service area is responsible for applying this policy to their records and creating a local implementation plan. Both physical and digital records should be managed properly.
Training materials and practical tools, including a self-assessment tool, are being developed and will be made available as soon as they are ready.
If you're unable to comply with any aspects of this policy, email nrrp@hse.ie for support.
Ann Sheehan, Policy Programme Lead for National Records Retention
Email: nrrp@hse.ie