Retention, legal holds and anonymisation
When a person has left your care, the law usually says how long you must keep their records. Once that time has passed, their identity can be removed (anonymised) while the care history is kept.
Where: Care → Retention, and profile → Legal holds. Who: care.retention.view; changes
need care.retention.manage. Both are sensitive and are never given by ADMIN. The Retention page
covers the whole organisation, not just your homes.
Approve only after checking the preview. There is no restore.
1. Set retention policies
No periods are provided. Retention periods are a legal decision for your organisation and country. Nothing becomes due until every category that applies to a person has a policy.
Where: Retention policies → Set (or Change) on a category.
| Field | What to enter | Example |
|---|---|---|
| Counts from | Discharge (the last discharge or closing date), Date of birth plus, Death (only once a death is recorded), or Recorded (access log only: each log row's own time) | Date of birth plus |
| Years | 1 to 150 | 75 |
| Legal reference | The law or guidance you rely on | Children's homes records guidance, 2026 |
| Notes | Optional | Approved by the trustees 12/10/2026 |
Select Save policy. Every change is listed under Policy changes, for example "6 Nov 2026 · Child care record: Date of birth plus + 75 years by james.cole".
The six categories
| Category | Applies to a person when | Example policy (illustration only) |
|---|---|---|
| Child care record | Their programme is anything other than elderly residential | Date of birth plus 75 years |
| Elderly care record | Their programme is elderly residential | Discharge plus 8 years |
| Health | They have any health record | Discharge plus 8 years |
| Incident | They are named on any incident | Discharge plus 10 years |
| Safeguarding | They are named on a safeguarding incident, or have a safeguarding concern | Discharge plus 25 years |
| Access log | Not per person: the log of who viewed what | Recorded plus 6 years |
The longest period wins
A person is due only when all their categories have passed. The latest date counts.
Example: Grace was discharged on 1 May 2006, aged 17, with incidents and a safeguarding concern.
| Category | Rule | Due |
|---|---|---|
| Child care record | Date of birth (14 Mar 1989) + 75 | 14 Mar 2064 |
| Incident | Discharge + 10 | 1 May 2016 |
| Safeguarding | Discharge + 25 | 1 May 2031 |
| Grace is due on | the latest of these | 14 Mar 2064 |
2. Review closed records
Where: Closed records. The list covers people who are Discharged, Deceased, Closed or Transferred out, with no open admission or enrolment. Due records are shown first.
| Column | Meaning |
|---|---|
| Beneficiary | The number |
| Categories | Which categories apply |
| State | Due, Not yet or Blocked |
| Due on | The date it becomes (or became) due |
| Why | The reasons it's blocked or not yet due |
| State | Typical reasons in Why | What to do |
|---|---|---|
| Blocked | "No retention policy for Health" | Set the missing policy. |
| Blocked | "Child care record: date of birth unknown" | Record the date of birth in Party, or use a discharge-based policy. |
| Blocked | An active legal hold | Wait for the hold to be lifted. |
| Blocked | The person has another active role (for example they are now an employee or a donor) | Their identity is still in use; they can't be anonymised. |
| Not yet | The due date is in the future | Nothing. |
| Not yet | "… is kept until death plus 5 years" | A death-based policy waits for a recorded death. |
| Due | (none) | Can be proposed. |
Preview: "What would change"
Select What would change on a row to see the preview "If BEN-000006 were anonymised":
- Changed: for example the name becomes "Anonymised person #…"; dates of birth and death are cut to the year; contacts, addresses, identifiers and relationships are removed; the alias, photo and identifying origin details are cleared.
- Kept: for example admissions, care plans, notes, incidents, safeguarding and health history, unchanged but no longer linked to a name.
3. Propose a disposal
- Tick the Due records to include.
- Optionally tick Also delete access-log rows older than the access-log policy. This needs an Access log policy. It deletes old log rows for the whole organisation, not just these people.
- Select Propose disposal (2). The page reminds you: "A different user must approve the proposal. Anonymisation cannot be undone."
Proposing changes nothing yet. Only records that are Due can be proposed ("Beneficiary … is not due for disposal").
4. Approve or reject (a second person)
Where: Disposals and certificates. The proposer cannot decide their own proposal: "A disposal must be decided by someone other than who proposed it".
| Button | What happens |
|---|---|
| Approve and anonymise | Asks "Approve disposal 4? 2 record(s) will be anonymised. This cannot be undone." Each person is checked again; anyone no longer due (for example because a legal hold was placed since) is Skipped, with the reason. The others are anonymised, and their status becomes Anonymised. |
| Reject | Asks "Why is disposal 4 rejected?" Nothing changes. |
The certificate
Each decided disposal stays on the page as a certificate:
Disposal 4
Proposed by james.cole 6 Nov 2026 09:10 · Approved by leah.brown 6 Nov 2026 11:42
Policies applied: CHILD_CARE_RECORD DOB+75; INCIDENT DISCHARGE+10; ...
Access-log rows deleted: 18 204
BEN-000006 · due 2026-05-01 · Anonymised
BEN-000011 · due 2026-02-14 · Skipped (legal hold placed)
It records who proposed and approved, when, the policies used and the result for each person. It never records the identity that was removed.
Legal holds
A legal hold stops a person's record being anonymised, for example during a court case, an inquiry or a complaint.
Where: profile → Legal holds. Who: care.retention.manage.
- Enter the Reason (required) and a Reference (optional). Example: "Historic abuse inquiry", reference "IICSA-2026-114".
- Select Place legal hold. The list shows "Historic abuse inquiry (IICSA-2026-114) · placed by james.cole 6 Nov 2026", marked Active.
To lift a hold: a different user selects Lift and answers "Why is this legal hold lifted?", for example "Inquiry closed, letter dated 01/12/2026". The person who placed a hold cannot lift it: "A legal hold must be lifted by someone other than who placed it".
Lifting a hold doesn't make the record due on its own. All the retention rules must still be met.
An anonymised record shows "This record has been anonymised under the retention policy."
What anonymisation does not do
- Names written inside free-text notes, document titles and earlier history entries are not rewritten.
- Backups are not touched.
- Other modules (finance, HR) are not affected.
- A person with another active role in the organisation is never anonymised.
- Nothing happens automatically. There is no scheduled disposal. Every disposal is proposed and approved by two people.
Example: a full run with two people
- James sets policies for all six categories (once).
- James opens Closed records: BEN-000006 is Due; BEN-000009 is Blocked ("No retention policy for Health"). He sets the Health policy, and BEN-000009 now shows Not yet.
- James selects What would change on BEN-000006 and reads the preview.
- James ticks BEN-000006, ticks the access-log option, and selects Propose disposal (1).
- Leah signs in, opens Disposals and certificates, checks the proposal and selects Approve and anonymise.
- The certificate shows BEN-000006 Anonymised and the number of access-log rows deleted.