Reviewing and evaluating electronic and hardcopy data that Business Units and individuals hold is an important first step to help ‘clear the clutter’, and will make the upcoming steps in the GDPR process easier in the long-term. If personal data is deleted/destroyed during this process, it will not form part of upcoming GDPR steps.

It is important to stress that all data must be reviewed carefully and responsibly, particularly personal data. All personal data that is kept will form part of upcoming stages in the GDPR process. The end of the entire process will see MVDC GDPR compliant.

We have listed some handy tips when considering whether to delete or retain the data (which could include personal data) you hold as a Business Unit, team or an individual:

1. Discuss as a team to help identify specific data which will need to be reviewed. This should be done first, before any further action is taken. Perhaps block out slot/s of time in calendars to go through what data is held as a team

• If your Business Unit shares an S: drive with one or more other Business Units, hold discussions with those Business Unit/s to confirm who has responsibility for specific folders/data. This will help to ensure another Business Unit’s data is not accidentally deleted

• MVDC’s Records Retention & Disposal Schedule should be used as the first point of reference for Business Units. The policy details the length of time Service-related data should be held for. This policy should not only be used for this exercise, but on an ongoing basis

• The BMT lead and Data Champion for your Business Unit will have a break-down of the records retention information specific to your Business Unit

• If the data you are reviewing is not included in the Records Retention & Disposal Schedule (which is not exhaustive), then it is down to a team’s or individual’s discretion, using common sense, as to whether to keep or delete/destroy that data

• When reviewing the data – think – is it used or referred to regularly? Is it still useful? Has it been duplicated? Is it necessary? Perhaps using the ‘Date Modified’ column could be a point of reference in your respective S: and H: drives

• If you are in any doubt about deleting or destroying data, please speak to your line manager, Corporate Head or Legal team before doing so. It may also be worth contacting peers from other Surrey Local Authorities in order to check standard practice

• BMT leads should keep a record of data being destroyed in their respective Business Unit’s. A note of what the data related to (and when it was destroyed) needs to be retained

• If as a Business Unit or individual you have data stored at Pippbrook House, this should be considered and reviewed as part of this process too

1. If you are intending to destroy paper or hardcopy data, please ensure you use the confidential waste bins located around Pippbrook. Contact the Facilities team for bags. They will also organise the collection of those bags. If you have collected more than five bags, please let the Facilities team know as that amount will need to be collected by a shredding contractor

1. Business Units wishing to archive permanent hardcopy data, please contact the Surrey History Centre on 01483 518737 or shs@surreycc.gov.uk