Personal data that’s no longer needed should be either:
deleted, or
anonymised
Electronically held data that’s deleted should be deleted as far as is technologically possible. The person carrying out the deletion must ensure that, after deletion, the data is beyond use (ie they must ensure that, if any traces remain, these traces cannot identify the person to whom the data relates). They should ensure that any offline or backup copies are also deleted.
Hard copy data that’s deleted should be destroyed to the extent that it is beyond use (eg shredded and mulched).
Anonymisation is an alternative to deletion. It involves personal data being altered into a form that does not allow identification in any way of the individual to whom the data relates. Anonymisation may be an appropriate alternative to deletion when it is useful for the organisation and the nature of the data and its anonymisation isn’t inappropriate (eg when the anonymised data doesn’t still pose a risk to the privacy of those to whom the data relates). For example, anonymisation may be appropriate for the purposes of conducting statistical analysis with a large, anonymous dataset.
For more information, read Data retention and document destruction.