Keeping data longer than necessary isn't caution — it's a breach. For FCA-regulated firms, erasure must be governed by a framework that balances data subject rights against mandatory retention obligations, documents every decision, and produces an audit trail both the ICO and FCA can inspect. Most firms have a retention schedule. Few have a complete erasure governance framework. The FCA doesn't wait.
What's included:
Four-category data classification: client data, financial records, communications, and compliance documentation — with sub-classification criteria
Retention period framework: regulatory periods, business function periods, multi-requirement scenarios, and review mechanisms
Erasure procedures: identification and review, technical erasure methods and standards, verification, and regulatory holds
Data subject rights: full Articles 15–21 framework with balancing rights against regulatory obligations
Governance: SMF accountability (SMF1/SMF4/SMF16), DPO responsibilities, Information Governance Committee, and three-lines-of-defence
Third-party management: AR obligations, data processing agreements, due diligence, and termination and data return
Ready-to-use appendices: Data Classification Matrix, Retention Schedule Template, Sector-Specific Requirement Mapping, and Third-Party Processing Checklist
+ much more
Who is this for?
Data Protection Officers, Compliance Officers, Information Governance leads, senior management, and IT security teams at FCA-regulated firms.
How it works
Step 1 — Read it. Every section exists for a reason, grounded in a specific regulatory obligation.
Step 2 — Understand it. Map the content against your current practices. Identify where you're strong and where gaps exist.
Step 3 — Make it yours. Tailor the language to reflect how your organisation actually operates. A policy that sounds like your firm is a policy your people will follow.
Step 4 — Take ownership. Assign clear accountability — Board approval, named SMF holder, designated policy owner. A policy without an owner is a liability, not an asset.
Step 5 — Operationalise it. Embed the policy into your governance calendar, training programme, and annual review cycle. This is where compliance becomes culture.
Or, get this free with RegTechPRO
Access this alongside the full compliance policy library — SM&CR, COBS, AML, Consumer Duty, GDPR, and more — for a fraction of the cost of consultancy.
View RegTechPRO pricing and packages →
Keeping data longer than necessary isn't caution — it's a breach. For FCA-regulated firms, erasure must be governed by a framework that balances data subject rights against mandatory retention obligations, documents every decision, and produces an audit trail both the ICO and FCA can inspect. Most firms have a retention schedule. Few have a complete erasure governance framework. The FCA doesn't wait.
What's included:
Four-category data classification: client data, financial records, communications, and compliance documentation — with sub-classification criteria
Retention period framework: regulatory periods, business function periods, multi-requirement scenarios, and review mechanisms
Erasure procedures: identification and review, technical erasure methods and standards, verification, and regulatory holds
Data subject rights: full Articles 15–21 framework with balancing rights against regulatory obligations
Governance: SMF accountability (SMF1/SMF4/SMF16), DPO responsibilities, Information Governance Committee, and three-lines-of-defence
Third-party management: AR obligations, data processing agreements, due diligence, and termination and data return
Ready-to-use appendices: Data Classification Matrix, Retention Schedule Template, Sector-Specific Requirement Mapping, and Third-Party Processing Checklist
+ much more
Who is this for?
Data Protection Officers, Compliance Officers, Information Governance leads, senior management, and IT security teams at FCA-regulated firms.
How it works
Step 1 — Read it. Every section exists for a reason, grounded in a specific regulatory obligation.
Step 2 — Understand it. Map the content against your current practices. Identify where you're strong and where gaps exist.
Step 3 — Make it yours. Tailor the language to reflect how your organisation actually operates. A policy that sounds like your firm is a policy your people will follow.
Step 4 — Take ownership. Assign clear accountability — Board approval, named SMF holder, designated policy owner. A policy without an owner is a liability, not an asset.
Step 5 — Operationalise it. Embed the policy into your governance calendar, training programme, and annual review cycle. This is where compliance becomes culture.
Or, get this free with RegTechPRO
Access this alongside the full compliance policy library — SM&CR, COBS, AML, Consumer Duty, GDPR, and more — for a fraction of the cost of consultancy.
View RegTechPRO pricing and packages →
Image 1 of 9
Image 2 of 9
Image 3 of 9
Image 4 of 9
Image 5 of 9
Image 6 of 9
Image 7 of 9
Image 8 of 9
Image 9 of 9
