Data Retention and Disposal Schedule

1.Principle

1.1

Personal data is kept no longer than is necessary for the purpose for which it is processed, in accordance with the storage limitation principle in Article 5(1)(e) UK GDPR.

1.2

A service register is, by its nature, a long-lived record: a vehicle's history is only useful if it survives changes of keeper across the vehicle's life. Service entries are therefore retained for the operational life of the vehicle, which is a necessity of the purpose rather than an exception to it.

1.3

Retention periods run from the trigger stated in Table 1. Where two periods apply to the same data, the longer applies.

2.Retention schedule

Ref	Category	Retention	Trigger	Justification
R1	Published service entries and their versions	Life of the vehicle, then 10 years	Vehicle recorded as destroyed or permanently exported	Integrity and continuity of the vehicle history record; protection of successive keepers
R2	Issued certificates and verification events	As R1	As R1	Certificates must remain resolvable for as long as they may be relied upon
R3	Draft records not submitted	12 months	Last modification	No continuing purpose once abandoned
R4	Evidence files attached to entries	7 years	Publication of the entry	Evidential support for a published declaration; limitation periods for contractual claims
R5	Workshop registration, verification and enforcement records	7 years	Workshop leaving the Register	Accountability for admission and enforcement decisions
R6	Insurance certificates and technician qualifications	7 years	Expiry of the document	Demonstrating eligibility at the time work was recorded
R7	Case correspondence, complaints and appeals	6 years	Closure of the case	Limitation Act 1980 period for contractual claims
R8	Compliance investigations and enforcement actions	10 years	Closure of the investigation	Pattern detection and fairness of repeat-conduct decisions
R9	Account and profile data	24 months	Last sign-in, or closure of the account if earlier	No continuing purpose once dormant
R10	Vehicle ownership claims	Duration of the claim, then 24 months	Claim withdrawn or superseded	Resolving disputed claims to the same vehicle
R11	Audit events	10 years	Creation of the event	The audit trail is the Register's assurance mechanism and cannot be selectively erased
R12	Operational and security logs	12 months	Creation of the log entry	Security monitoring, abuse prevention and fault diagnosis
R13	Risk events raised by monitoring	6 years	Resolution of the event	Demonstrating that indicators were acted upon
R14	Anonymised statistical aggregates	Indefinite	n/a	No longer personal data; published for transparency

Table 1 — Retention schedule. Categories are reviewed annually against the purposes stated in the Privacy and Data Protection Policy (NVSR-GDPR-001).

3.Disposal

3.1

At the end of a retention period, data is either securely deleted or irreversibly anonymised so that no individual remains identifiable, directly or indirectly.

3.2

Deletion of a database row removes it from live systems; encrypted backups are held on a rolling cycle and expire within 35 days, after which the data is unrecoverable. Files in private storage are deleted at object level.

3.3

Where an entry must be removed but the vehicle history must remain coherent, the Register redacts the personal elements and retains the structural record — that a service was recorded, on what date, and by which workshop reference — as permitted by Article 17(3) UK GDPR.

4.Legal hold

4.1

Where data is relevant to an ongoing investigation, complaint, appeal, regulatory enquiry, insurance claim or legal proceedings, disposal is suspended until the matter concludes. The hold and its reason are recorded.

4.2

A legal hold overrides an erasure request to the extent that retention is necessary for the establishment, exercise or defence of legal claims.

5.Erasure requests

5.1

A data subject may request erasure through the contact form under category C5. Each request is assessed individually against the grounds in Article 17 UK GDPR.

5.2

The Register will explain, in writing and with reasons, where an element cannot be erased — typically because it forms part of the immutable audit trail or is required for the defence of legal claims — and will confirm what has been erased or redacted.

6.Review

This Schedule is reviewed annually. Any change to a retention period is published as a new version under this document reference before it takes effect.

Document control

Reference: NVSR-DRP-001
Version: 1.0
Classification: Public
Review: Annually