Last reviewed: November 2026
Mosaic Group Limited will not retain personal information or business records for longer than is necessary for the purpose for which they are held.
Retention periods will take account of:
legal and regulatory requirements;
contractual obligations;
legitimate business requirements;
applicable limitation periods;
health and safety requirements; and
the rights and interests of individuals.
Information that is no longer required will be securely deleted, anonymised or destroyed.
This policy should be read alongside Mosaic’s Data Protection Policy, Privacy Notice and Information Security policies.
Records should normally be retained for the periods set out in this policy.
A longer period may be used where there is a documented legal or business justification.
Where litigation, an investigation, audit, insurance claim or regulatory enquiry is underway or reasonably anticipated, relevant records must not be destroyed until the matter has concluded.
Duplicate and convenience copies should be deleted when no longer required.
Retention requirements apply to both electronic and paper records.
Special category and criminal offence information should receive additional protection and should not be retained merely because other information in the same file is retained.
At the end of the applicable period, information should be securely destroyed or anonymised unless continued retention can be justified.
| Record type | Standard retention period |
|---|---|
| General website or contact enquiries where no business relationship develops | 12 months after last meaningful contact |
| General business correspondence | Retain while relevant; up to 6 years where connected with a contractual, financial or material business relationship |
| Customer and supplier contact records | Duration of active relationship plus up to 6 years where required for contractual, financial or legal purposes |
| Contracts and agreements executed as simple contracts | 6 years following expiry, termination or completion |
| Contracts executed as deeds | 12 years following expiry, termination or completion |
| Customer orders, purchase orders, invoices, receipts, delivery records and debtor/creditor records | 6 years following the end of the relevant financial/accounting period |
| Corporation Tax and supporting financial records | At least 6 years from the end of the relevant accounting period, or longer where required |
| PAYE, payroll, pay deductions, benefits in kind and related pay and tax records | Normally 6 years following the relevant tax year/pay reference period |
| Employee personnel records, contracts, disciplinary/grievance records and termination records | Employment period plus 6 years, unless another statutory period applies |
| Employee emergency contact details | Delete promptly once employment ends unless still required for a specific reason |
| Routine sickness and absence records | Retain only for as long as required for employment, legal or management purposes; normally no longer than employment plus 6 years |
| Health surveillance records subject to COSHH or equivalent legislation | Period required by the relevant regulations; for applicable COSHH health records this may be 40 years |
| Other occupational health or medical information | Retain only for as long as necessary for the relevant employment, legal or health and safety purpose |
| Successful recruitment records | Relevant material transferred to the employee file; unnecessary recruitment material deleted after appointment |
| Unsuccessful job applications, interview notes and recruitment records | Normally 12 months after completion of the recruitment exercise |
| Speculative employment enquiries where no formal application follows | 12 months after last meaningful contact |
| DBS certificate or certificate information | Normally no longer than 6 months after the relevant decision |
| Limited record that a DBS check was undertaken | Retain only where necessary, recording appropriate details rather than the certificate itself |
| Marketing contact records | While the relationship or marketing purpose remains current, subject to periodic review |
| Marketing suppression/opt-out records | Retain for as long as necessary to ensure the individual’s preference continues to be respected |
| Complaints and associated correspondence | Normally up to 6 years after closure where necessary for business or legal purposes |
| Data protection complaints | Normally up to 6 years after closure, subject to the circumstances and sensitivity of the information |
| Subject access and other individual-rights requests | Normally 3 years after closure unless a dispute or claim justifies longer retention |
| Personal data breach records | Normally up to 6 years after closure, with sensitive supporting information reviewed and minimised where appropriate |
| Insurance policies and claims | Duration of the policy or claim plus the relevant limitation period; normally at least 6 years after closure where appropriate |
| Litigation and legal claim files | Until proceedings and relevant appeal or limitation periods have expired; seek legal advice where necessary |
| Intellectual property and trade mark records | Duration of the relevant rights plus any period necessary to establish or defend ownership |
| Asset registers | Life of the asset plus the period required for accounting and tax purposes |
| Software licences and material IT contracts | Duration of licence or contract plus up to 6 years where relevant |
| Website security and server logs | Retain only for as long as necessary for security, troubleshooting, hosting and incident investigation purposes |
| Cookie preference records | Retain only for as long as reasonably necessary to remember the user’s cookie/privacy choice |
Health surveillance records must be distinguished from confidential medical records.
Where health surveillance is required by legislation, Mosaic will retain the relevant health record for the period required by the applicable regulations.
Confidential clinical or medical information held by an occupational health professional will remain subject to medical confidentiality and appropriate access controls.
DBS certificate information must be handled securely and used only for the purpose for which it was obtained.
Certificate information should normally be destroyed as soon as it is no longer required and usually no later than six months after the relevant decision.
Where appropriate, Mosaic may retain a limited record confirming that a check took place without retaining the certificate or detailed disclosure information.
Departments responsible for records must periodically review information under their control and dispose of information that has reached the end of its retention period.
Where a record is not clearly covered by this schedule, the Data Protection Lead should determine an appropriate retention period based on:
the purpose for which the information is held;
applicable legal requirements;
relevant limitation periods;
sensitivity of the information; and
the risks associated with continued retention.
Paper records containing confidential or personal information must be securely shredded or disposed of through an approved confidential-waste process.
Electronic information must be securely deleted from live systems in accordance with Mosaic’s information-security arrangements.
Information held within backups will be managed in accordance with Mosaic’s backup and system-retention arrangements and must not be restored for ordinary business use once the underlying information should have been deleted.
Normal destruction must be suspended where records may be relevant to:
actual or anticipated litigation;
a regulatory investigation;
an insurance claim;
an audit;
a data protection request or complaint; or
another matter requiring preservation of evidence.
Records should be returned to the normal retention cycle once the hold is no longer required.
This policy will be reviewed at least annually through the IMS Management Review process and sooner where there is a significant change in:
law or regulatory guidance;
Mosaic’s systems or processing activities;
business requirements; or
identified risks.
MOSAIC GROUP
YORK HOUSE
WETHERBY RD
LONG MARSTON
YORK
NORTH YORKSHIRE
YO26 7NH
