Last updated: February 2026 · Next review due: February 2027
1. Purpose and Scope
This document defines the data retention, deletion, and privacy framework for the HLB Global Independence System (GIS). It serves as the Record of Processing Activities (RoPA) required under GDPR Article 30 and as the technical reference for data lifecycle management.
The GIS processes two distinct categories of data:
- Professional records — conflict checks, independence assessments, audit trail entries, and related decision documentation. Subject to professional and regulatory retention obligations.
- Personal data — user profiles, names, email addresses, job titles, and authentication records. Subject to UK GDPR and equivalent legislation.
HLB International Limited acts as the data controller for network-level data. Member firms act as data controllers for their own client and user data.
2. Legal Basis for Processing
| Data Category | Legal Basis | Relevant Legislation |
|---|---|---|
| Conflict check records | Legal obligation / Legitimate interest | IESBA Code of Ethics Parts 4A & 4B; local audit regulations |
| Independence assessment records | Legal obligation | IESBA Code; PCAOB (US); FRC (UK); local equivalents |
| Audit trail entries | Legal obligation / Legitimate interest | GDPR Article 6(1)(c) and (f); audit file retention requirements |
| User profile data | Legitimate interest / Contract performance | GDPR Article 6(1)(b) and (f) |
| Data usage agreement records | Legal obligation | GDPR Article 7(1) — consent documentation |
| Entity register data | Legitimate interest | IESBA Code; data usage agreement |
3. Retention Schedule
3.1 Professional Records — Minimum 6 Years
Professional records must be retained for a minimum of 6 years from creation or closure, whichever is later. Where US PCAOB Rule 4006 applies, the period extends to 7 years.
| Record Type | Retention Period | Deletion Approach |
|---|---|---|
| Conflict checks | 6 years (7 for US-regulated firms) | Archive then delete |
| Conflict check responses | Same as parent check | Cascade with parent |
| Audit logs | 6 years from creation | Archive then delete |
| Data usage agreements | 6 years from acceptance | Archive then delete |
| Entity records | 6 years from last update | Archive then delete |
3.2 Personal Data — Active Duration Plus 2 Years
Personal data is retained only for the duration of the individual's active relationship with the system, plus a 2-year administrative period, after which it is pseudonymised.
| Data Type | Retention Period | Action on Departure |
|---|---|---|
| User profiles (name, job title) | Active + 2 years | Pseudonymise |
| Authentication data (email) | Active + 2 years | Deactivate and pseudonymise |
| Role assignments | Retained for audit integrity | Pseudonymise user reference |
| Unaccepted invitations | 90 days | Delete automatically |
| Notifications | 90 days | Delete automatically |
3.3 Firm Records — Membership Duration Plus 6 Years
Firm records are retained for 6 years after withdrawal from the network. Firm status is set to "withdrawn" and the record retained for historical reference.
4. Pseudonymisation
When a user departs or a firm withdraws, personal data is pseudonymised rather than deleted to preserve the integrity of professional records. The standard format is:
full_name: "[FORMER USER — YYYY-MM-DD]" job_title: "[REDACTED]" actor_email: "[FORMER USER — YYYY-MM-DD]"
User UUIDs are retained unchanged as foreign keys. This ensures audit trails continue to show that actions were performed without retaining identifiable data.
5. Annual Cleansing Process
- Identify — Query records exceeding retention thresholds
- Review — Global Admin reviews eligible records (no automated deletion)
- Archive — Export to encrypted archive before deletion
- Delete — Execute deletion with admin approval; log to audit trail
- Document — Create formal cleanse record (retained for 6 years)
6. Subject Access and Erasure Requests
Under UK GDPR Article 15, individuals may request a copy of their personal data (response required within 30 days). Under Article 17, individuals may request erasure — fulfilled through pseudonymisation where professional retention obligations apply. Where erasure is limited, the decision is documented with the legal basis for continued retention.
7. International Transfers
As a global network, data may be transferred outside the UK. Principal regional considerations include:
| Region | Additional Requirement |
|---|---|
| United States (PCAOB) | 7-year retention for audit-related records |
| United Kingdom | UK GDPR equivalent; FRC audit file requirements |
| Germany | Stricter legitimate interest interpretation |
| France | CNIL guidance on employee monitoring |
| Australia | Privacy Act 1988 — consistent with GDPR baseline |
| Singapore | PDPA — consistent with GDPR baseline |
| Canada | PIPEDA — consistent with GDPR baseline |
8. Data Breach Response
- Notify the ICO within 72 hours where the breach poses a risk to individuals
- Notify affected member firms promptly
- Use the GIS audit trail as the primary evidence source
- Retain breach response records for a minimum of 6 years
9. Responsibilities
| Role | Responsibility |
|---|---|
| HLB International — Global Independence | Policy owner; approves annual cleanse; handles network-level SARs |
| Global Admin (GIS) | Executes pseudonymisation and cleanse; approves deletion |
| Firm Admin | Data accuracy; notifies of departed users |
| Compliance Officer | Reviews local regulatory requirements |
10. Contact
For data retention enquiries, please contact:
John Toon
Global Independence System
HLB International Limited
123 Buckingham Palace Road
London SW1W 9SH
United Kingdom
Formal data protection enquiries and data subject requests should be directed to the contact given in the Privacy Policy. Privacy Policy.
Document reference: GIS-DRP-001 · Version 1.0 · This document must be reviewed annually and updated whenever a material change is made to the GIS database schema or data processing activities.