Records Retention and Disposal Policy

Al-Waris Foundation creates and receives records relating to its:

The charity is committed to keeping records for appropriate periods and securely disposing of information when it is no longer reasonably required.

Records must not be:

This policy establishes a framework for:

This policy applies to records held by or on behalf of Al-Waris Foundation.

It applies to:

It applies regardless of whether information is held:

Al-Waris Foundation will seek to ensure that records are:

The Board of Trustees retains overall responsibility for appropriate records governance.

Operational responsibility may be delegated to authorised persons responsible for:

Records created or received in the course of authorised Al-Waris Foundation activity normally belong to the charity rather than the individual who created them.

This may include records stored temporarily on:

Important charity records should be transferred into appropriate charity-controlled storage where reasonably practicable.

The charity should not retain personal information merely because storage is available.

Records containing personal data should be limited to information reasonably required for legitimate purposes.

Retention periods should take account of:

The schedule in this policy provides Al-Waris Foundation's normal internal retention framework.

A record may be retained for longer where there is a legitimate reason.

A statutory requirement or legal obligation takes precedence over an internal period stated in this policy.

The following should normally be retained permanently:

Approved trustee and Board meeting minutes should normally be retained permanently.

Supporting meeting papers may be retained according to their continuing governance, legal or historical significance.

Superseded versions of significant governance policies should normally be retained to provide an audit trail.

Records should identify where reasonably practicable:

Registers and declarations of trustee conflicts should normally be retained for at least 6 years after they cease to be current, unless a longer period is justified.

Records connected to a significant governance matter may be retained longer.

Final annual reports, annual accounts and submitted regulatory returns should normally be retained permanently as part of the charity's historical governance record.

Accounting records should normally be retained for at least 6 years after the end of the relevant financial period, subject to applicable legal or tax requirements.

These may include:

Bank statements, reconciliations and material supporting banking records should normally be retained for at least 6 years after the relevant financial period.

Records connected to unresolved transactions or disputes should be retained longer where necessary.

Donation transaction records should normally be retained for at least 6 years after the relevant financial period.

This may include:

Personal donor information should not be retained longer than necessary merely because transaction records must be retained.

Records demonstrating the creation, receipt, application and closure of restricted funds should normally be retained for at least 6 years after the fund has been fully applied or otherwise lawfully resolved.

Material records may be retained longer where necessary to demonstrate compliance with donor restrictions.

Where Gift Aid is operated, declarations and associated records should be retained for the period required by applicable HMRC rules.

The current HMRC requirement should be checked when Gift Aid functionality is activated or administered.

Material fundraising records should normally be retained for at least 6 years after the relevant Appeal or campaign closes.

These may include:

This helps demonstrate what donors were told when donations were received.

Records concerning permanent or long-term Causes may remain active for as long as the Cause operates.

Historical versions of material fundraising terms should be retained where necessary to understand earlier donations.

Material project records should normally be retained for at least 6 years after project completion.

Records may include:

Al-Waris Foundation should maintain a durable record for each completed water installation.

The record should normally include:

Core records identifying the installation and its location may be retained for the operational life of the installation and beyond where useful for accountability and historical project records.

Maintenance, repair and warranty records should be retained for as long as they remain relevant to the installation.

Significant records may be linked permanently to the project's core record.

Material food-distribution records should normally be retained for at least 6 years where required for financial or project accountability.

Records may include:

Beneficiary-identifying information should only be retained where genuinely required.

Emergency and disaster-response records should normally be retained for at least 6 years after completion.

Longer retention may be appropriate where the activity involves:

Material procurement records should normally be retained for at least 6 years after completion of the transaction or contract.

These may include:

Contracts should normally be retained for the duration of the agreement and for at least 6 years after termination or expiry, unless a longer period is appropriate.

Contracts executed as deeds or involving longer legal limitation periods may require longer retention.

Routine supplier information should be retained for as long as the relationship remains active and thereafter only for as long as necessary for:

Due-diligence records for significant contractors should normally be retained for at least 6 years after the relationship or relevant project ends.

High-risk or disputed relationships may justify longer retention.

Records relating to grants made by Al-Waris Foundation should normally be retained for at least 6 years after the grant is completed or closed.

This may include:

Expense claims and supporting evidence should normally be retained for at least 6 years after the relevant financial period.

Records relating to public or street collections should normally be retained for at least 6 years where they form part of financial records.

This may include:

Material payment-processor records should normally be retained in line with financial-record requirements.

The charity does not need to duplicate information indefinitely where reliable records remain available elsewhere and appropriate access is assured.

Routine volunteer records should normally be retained for the duration of the volunteer relationship and for an appropriate period afterward.

A general retention period of up to 6 years after the relationship ends may be appropriate where records remain relevant to:

Unnecessary personal information should be removed earlier where appropriate.

Unsuccessful volunteer applications should normally be retained only for a limited period unless there is a legitimate reason for longer retention.

As a general internal period, they should normally be deleted within 6 to 12 months after the recruitment process ends.

Recruitment records should be retained according to:

Unsuccessful applicant records should not be retained indefinitely.

Information relating to criminal-record checks requires particular care.

The charity should not routinely retain copies of DBS certificates longer than necessary.

Where appropriate, the charity may record limited information such as:

Applicable DBS handling requirements should be followed.

Safeguarding records may require significantly longer retention than ordinary administrative records.

Retention should consider:

Safeguarding records must not be automatically deleted under a routine six-year rule.

Where a safeguarding record reaches a proposed disposal date, an appropriately authorised person should assess whether deletion is safe and appropriate.

Professional safeguarding or legal advice should be obtained where necessary.

Records concerning serious incidents should normally be retained for at least 6 years after closure, and longer where:

Routine complaint records should normally be retained for at least 3 years after closure.

A longer period may be appropriate where the complaint involves:

Whistleblowing records should be retained according to the seriousness and outcome of the concern.

Material substantiated matters may require retention for at least 6 years or longer.

Records should be kept confidential and access restricted.

Records relating to suspected or confirmed:

should normally be retained for at least 6 years after closure, unless legal, regulatory or investigative requirements justify longer retention.

Material sanctions or financial-crime due-diligence records should be retained for an appropriate period demonstrating the checks undertaken.

The appropriate period should reflect the nature and risk of the relationship.

Routine accident and health and safety records should normally be retained for at least 3 years from the relevant incident, subject to longer applicable requirements.

Longer retention may be required where:

Current insurance policies should be retained throughout their period of cover.

Historic policies and significant claims records should be retained where they may be relevant to future claims.

Some liability claims may arise many years after the relevant event, so potentially relevant historic insurance evidence should not be destroyed without appropriate consideration.

Material premises records should be retained for the duration of occupation and for an appropriate period afterward.

These may include:

Legal or financial records should follow the applicable longer retention period.

Records connected to a disputed utility liability or enforcement matter should be retained until:

Such records must not be destroyed merely because the charity leaves the premises.

Records relevant to actual or reasonably anticipated legal proceedings must not be destroyed while they may remain relevant.

This applies even where their normal retention period has expired.

Where litigation, regulatory investigation, safeguarding investigation, fraud investigation or another serious dispute is reasonably anticipated, relevant deletion should be suspended.

This is referred to in this policy as a legal hold.

A legal hold may apply to:

Relevant records should be preserved until the hold is formally lifted.

Records relevant to an active data-protection request should not be deleted merely because a routine deletion date occurs during processing.

The charity should preserve what is reasonably necessary to respond properly.

Records demonstrating data-protection compliance should be retained for as long as reasonably necessary.

These may include:

Records of personal-data breaches should be retained for an appropriate period sufficient to demonstrate:

Material incidents may warrant retention for at least 6 years.

Where processing or publication relies upon consent, evidence of that consent should normally be retained for as long as the relevant processing continues and for an appropriate period afterward.

A record of withdrawal should also be retained where necessary to ensure the withdrawal continues to be respected.

Beneficiary information should be retained only for as long as necessary for:

Beneficiary data should not automatically be retained for six years merely because financial records relating to the same project are retained for six years.

Copies of identity documents should only be retained where genuinely necessary.

Where verification can be recorded without retaining a complete identity document, this may reduce risk.

Project photographs and videos should be retained according to:

Not every raw media file needs to be retained permanently.

A limited selection of important project evidence may be retained for longer periods where it provides a legitimate historical or accountability record.

Sensitive beneficiary imagery should receive separate consideration.

AI-generated illustrations that do not contain personal data may be retained according to ordinary content-management needs.

They should remain distinguishable from genuine project evidence where confusion could otherwise arise.

Published website content may be retained while current.

Material historical versions should be preserved where they are relevant to:

The charity's CMS may retain previous content versions to support:

Version history should not become an indefinite repository for personal data that should otherwise have been deleted.

A completed fundraising Appeal may remain publicly available as a historical record where appropriate.

The charity should consider removing or updating:

Social-media posts may remain publicly available where they continue to serve a legitimate purpose.

Older posts should be reviewed where they contain:

Email should not automatically be treated as permanent storage.

Important emails should be retained according to their content rather than merely because they exist in a mailbox.

Routine low-value correspondence may be deleted when no longer needed.

Emails forming evidence of:

should be retained according to the underlying record category.

Important charity decisions or evidence should not rely indefinitely on personal messaging history.

Where messages contain material records, relevant information should be transferred or preserved appropriately.

Messages involving:

should be transferred into appropriate charity records where necessary.

Routine enquiries should be retained only as long as necessary to respond and administer the matter.

Where an enquiry develops into another record category, such as:

the applicable retention period should then apply.

Marketing subscription records should be retained while necessary to administer the subscription.

Where someone unsubscribes, sufficient suppression information may need to be retained to ensure they are not inadvertently resubscribed without an appropriate basis.

Analytics data should be retained only for a reasonable period consistent with:

System audit logs should be retained for a period proportionate to:

Critical financial or administrative audit information may require longer retention than ordinary technical logs.

Security logs should normally be retained long enough to support investigation of incidents that may not be discovered immediately.

The exact period may vary according to:

Backups are for recovery and must not be used as a means of deliberately retaining data indefinitely beyond its proper retention period.

Deletion from backups may occur through normal backup rotation where immediate selective deletion is technically impracticable, provided deleted data is not restored into active use improperly.

Paper records containing confidential information should be:

Paper records may be digitised where appropriate.

Before destroying an original after scanning, the charity should consider whether:

Unnecessary duplicates should not be retained indefinitely.

Where a reliable master record exists, redundant copies may be securely deleted.

Routine drafts may normally be deleted once a final version is approved.

Drafts should be retained where they have material evidential, legal or governance significance.

Temporary exports, downloads and working copies containing confidential information should be deleted when no longer required.

Particular care should be taken with:

Charity records stored on personal devices remain subject to this policy.

When the information is transferred to appropriate charity storage, unnecessary local copies should be deleted where reasonably practicable.

When a person leaves Al-Waris Foundation, they should return or transfer charity records within their possession or control.

They should not retain confidential charity information without a legitimate reason and appropriate authority.

Deletion from cloud systems should take account of:

The charity should use available controls proportionately.

Records containing confidential or personal information must be disposed of securely.

Appropriate methods may include:

Confidential paper records must not be placed intact into ordinary recycling where unauthorised people could access them.

Before selling, donating, recycling or disposing of devices used for charity records, information should be securely removed where reasonably practicable.

A normal file deletion may not be sufficient.

Storage devices containing highly sensitive charity information should be:

before disposal where appropriate.

For routine records, individual deletion records are not always necessary.

For significant bulk or sensitive destruction, the charity may maintain a disposal record identifying:

Systems may use automated retention and deletion where appropriate.

Automated rules should be:

Material governance, safeguarding, legal or financial records should not be destroyed casually.

Where there is uncertainty, an appropriately authorised person should review the proposed disposal.

No record may be destroyed, altered or hidden for the purpose of:

Records potentially relevant to an internal or external investigation should be preserved.

This may include investigations involving:

Al-Waris Foundation is not automatically subject to the Freedom of Information Act merely because it is a registered charity.

However, other disclosure obligations may apply depending on circumstances.

Records should not be destroyed merely because a person has requested information.

Records reasonably required by the Charity Commission should be preserved and supplied where the charity is lawfully required to do so.

Applicable HMRC retention requirements take precedence over shorter internal periods.

Current requirements should be checked where necessary.

Where an insurer requires records to be retained for a particular period, relevant records should be preserved accordingly.

Al-Waris Foundation may retain selected records permanently because of legitimate historical value.

Examples may include:

Historical retention should still consider privacy and safeguarding.

Where the informational value of a record can be preserved without identifying individuals, anonymisation may allow longer-term statistical or historical use.

Anonymisation should be sufficiently robust that individuals are no longer reasonably identifiable.

Pseudonymisation may reduce risk but does not necessarily make information anonymous.

Pseudonymised personal data remains subject to data-protection requirements where re-identification remains reasonably possible.

The charity should periodically review significant record categories.

Reviews should identify:

Where reasonably practicable, new digital systems should support appropriate:

Records governance should be considered when systems are designed rather than only after data has accumulated.

Deleting information from a user interface does not necessarily remove every database record.

Technical deletion procedures should reflect:

Where a donor requests deletion of their account, the charity may still need to retain certain transaction records for:

Unnecessary profile information should be deleted or anonymised where appropriate.

Records necessary to demonstrate genuine charitable transactions must not be deleted merely because an associated person requests account deletion.

The charity should instead minimise or separate personal information where possible while preserving required financial evidence.

Where records must be retained, reasonable steps should be taken to correct materially inaccurate personal information where required.

Historical records may sometimes preserve the original entry together with a correction rather than silently rewriting the historical record.

Access should be based on legitimate need.

Examples include:

Trustees should be provided with information reasonably necessary to discharge their governance duties.

This does not require unrestricted technical or operational access to every underlying system.

Retention does not mean unrestricted availability.

Sensitive retained records should continue to receive appropriate confidentiality protection for their entire retention period.

Digital and physical records should be protected according to the Information Security and Cybersecurity Policy.

Long-term archives should not become forgotten unsecured repositories.

Improper disposal may constitute a personal-data breach.

Examples include:

Such incidents should be assessed under the Data Protection and UK GDPR Policy.

Where a contractor stores charity records, contractual arrangements should address appropriate:

The charity should not assume a contractor automatically deletes information when the relationship ends.

Records created during overseas operations remain subject to appropriate Al-Waris Foundation governance.

Practical local constraints may affect how evidence is initially collected, but material records should be transferred into suitable charity systems where reasonably practicable.

Where personal data is stored or accessed internationally, applicable data-protection requirements concerning international transfers should be considered.

People handling significant charity records should understand:

Breaches may include:

Appropriate action may include:

This policy should be read alongside:

This policy will be reviewed:

Version: 2.0 Status: Approved Approved by: Board of Trustees Approval date: 25/08/2026 Next scheduled review: 24/08/2027