3. Retention, disposal and CCTV

Keep for a reason

Retention should follow a written schedule (adult and child clinical records have different typical periods in UK professional guidance — use the current published figures your indemnity and defence organisations recommend, and the NHS rules that apply if you hold NHS records). “Keep everything forever on a spare hard drive in a drawer” is not a schedule. Neither is shredding last week’s notes because the cabinet is full.

Disposal

Paper: cross-cut shred or a confidential-waste contractor with a certificate. Computers and sensors: wipe or destroy disks so records cannot be resurrected from a skipped eBay listing. Check the photocopier hard disk when the lease ends.

CCTV

Cameras can be justified for security of premises and staff — not for watching how long a nurse takes in the staff room. Tell people they are there (signs). Do not point audio-recording microphones at clinical conversations unless you have a very clear, lawful, necessary purpose. Retention of footage should be short and stated. Subject access can include CCTV stills of the requester.

Series close

Module 1: lawful records, roles, everyday security. Module 2: rights, breaches, retention. Together they are 2 hours of verifiable CPD.

Always follow current UK data protection law, ICO guidance, GDC Standards, and indemnity advice when a claim or ICO file is in view.