Twelve Months of Letting Go: An Evidenced Disposal Calendar for UK Data Teams
Retention schedules often look complete in a policy folder. The harder question is whether records are actually being disposed of, on time, with evidence that a governance committee can rely on. A one-off inherited-estate audit answers a different question: it maps accumulated debt. The disposal calendar described here is the recurring operating rhythm that prevents the debt from returning.
For UK data governance teams, storage limitation is not satisfied by a schedule alone. It is satisfied by a demonstrable process: owners confirm what should go, legal holds are checked, deletion is executed across primary and secondary copies, and exceptions are recorded. The calendar turns that process into twelve monthly checkpoints.
Why a calendar, not another policy
A policy says what should happen. A calendar says who does what, when, and what evidence is produced. The distinction matters at board level. Committees do not need another statement that retention is important; they need a trend line showing that disposal is occurring and that exceptions are being managed.
The calendar should be owned by the data governance function but delivered with records owners, IT operations, legal, information security and, where relevant, procurement. Each month has a primary focus, but three gates recur throughout: legal hold clearance, owner attestation and deletion sign-off. No disposal run should proceed without all three.
The twelve-month rhythm
The sequence below can start in any month. What matters is that the cycle is repeated and evidenced.
| Month | Focus | Evidence produced |
|---|---|---|
| January | Refresh the record inventory and confirm owners | Owner list, system scope, priority schedule |
| February | Reconcile legal holds against disposal candidates | Hold clearance log, released items |
| March | Review shared drives and collaboration workspaces | Workspace disposition list, owner sign-off |
| April | Test line-of-business applications and SaaS retention rules | Configuration evidence, exception list |
| May | Check backups and secondary copies | Backup disposal confirmation, restore caveats |
| June | Address legacy systems and orphaned repositories | Legacy disposition plan, risk acceptance |
| July | Complete mid-year deletion sign-off | Signed disposal certificate, exception report |
| August | Obtain processor return and deletion evidence | Vendor confirmation, contract reference |
| September | Review email and messaging retention | Mailbox disposition report, hold check |
| October | Cover paper, offsite and unstructured records | Destruction certificates, collection notes |
| November | Prepare annual attestation and metrics pack | Attestation statement, dashboard |
| December | Present board evidence and set next-year plan | Board paper, remedial actions |
This is not a checklist to be completed by one team in isolation. Shared drives and collaboration workspaces are common blind spots because ownership is diffuse. Legacy systems are common exceptions because deletion may require decommissioning work. Backups require a careful explanation: deletion from a live system does not always mean immediate deletion from every backup, but the organisation should be able to state its backup retention period and why it is justified.
Legal holds and deletion sign-off
Legal hold is the first gate, not an afterthought. Before any disposal run, the team should reconcile the disposal candidate list against active and reasonably anticipated litigation, regulatory investigation and employment matters. The reconciliation should be recorded. Where a hold is released, that release should be dated and authorised.
Deletion sign-off should be similarly explicit. A named owner should confirm that the records listed are no longer required for operational, legal, regulatory or contractual reasons. IT or the relevant system owner should confirm execution. The evidence should include the date, system, record category, volume where available, method and any exceptions. A short certificate is usually enough; the point is that it can be produced later.
Metrics that show disposal is happening
A useful dashboard needs only a small number of measures: disposal candidates scheduled this month; percentage completed; open exceptions; overdue legal-hold reviews; owner attestation rate; and the age profile of the oldest retained records in priority systems. Volume deleted is less important than completed decisions and closed exceptions.
The board pack should show the trend across at least two quarters. A rising exception count is not automatically a failure; it may reveal that the schedule is being tested realistically. An exception count that never changes is more likely to indicate that the process is not running.
Keeping it distinct from an inherited-estate audit
An inherited-estate audit is a project: it discovers, maps and remediates accumulated data governance debt. The calendar is a control: it keeps the estate from silently re-accumulating debt. The audit may produce the first inventory and the first exception register. The calendar then tests that register every month and escalates what cannot be resolved.
For UK organisations, the practical test is simple. If a regulator, auditor or board member asked in six months for evidence that a particular record category had been disposed of, could the team produce a dated, owner-approved trail? If not, the policy may exist, but the control does not.
A realistic start
Begin with three priority systems, one records owner group and one legal-hold reconciliation. Run the cycle for a quarter before expanding. The aim is not a perfect annual purge; it is a repeatable rhythm that makes disposal visible, defensible and ordinary.
