A data retention policy is a set of guidelines which helps organisations to keep track of how long information must be kept and how to dispose of the information when it’s no longer needed. The policy should also outline the purpose for processing the personal data.