As a service provider, you are required to develop a policy setting out what kinds of personal information records you maintain and how long you will keep (retain) them.

Part X does not dictate how long you must keep records, but it does require you to consider certain factors in deciding your retention periods. For example, you must consider whether another service provider needs the record to provide services.

Regardless of your retention periods, if someone requests access to a record, you must then retain it for as long as it takes to fulfil their access request and any follow up they may have (including filing a complaint with the IPC).

Learn more about retaining and disposing of records in the guide to Part X

This post is also available in: French