Management control of the lifecycle of data – from creation to destruction – is a central column of good data management, but is increasingly difficult as technologies give individuals capacity and capability to create vast amounts of data with few means for practical oversight. Where this is personal data, legislation requires that the data be held for only a limited justifiable time related to its purpose.

Establishing control and determining what is an appropriate length of time to retain data, particularly in health and social care, where a longitudinal view of population health informs system design and supports targeted interventions is vital, as this data is also of the type most likely to cause harm through inappropriate use.

Kaleidoscope can support organisations in designing lifecycle controls and in drawing-up justifiable retention schedules, which can then feed in to the satisfaction of other statutory duties, for example, the right of data subjects to be informed for how long their data will be retained.