Lawful Bases and Retention Periods Inside a Documentation Engagement

A documentation engagement processes personal data the client supplies — bank statements, identification, correspondence, venue exports. The processing is lawful only where a defined basis applies and the basis is recorded at intake. DC-SERVICES records the basis in the scope letter and repeats it inside the engagement file so the lawful ground is visible to a reviewer rather than implied by the existence of the file.

Contract is the basis used for most engagements: the processing is necessary to deliver the documentation service the client asked for and signed for. Legitimate interests cover narrow internal activities such as conflicts checking. Legal obligation covers retention required by anti-money-laundering rules or other statutory duties. Consent is used only where no other basis applies and where withdrawal would not destabilise the file.

Special-category data is handled separately. Where a record incidentally contains health, biometric or other sensitive fields, the field is noted, minimised where possible, and processed only where a special-category condition applies. The file records the condition. It does not blanket every engagement under one heading or rely on a basis that does not actually fit the records the client supplied.

Retention is defined at intake rather than at closure. The file records how long each class of record will be held and on what authority — statutory retention, contractual retention, or the firm's own documented period for sealed archive copies. A reviewer or a regulator can read the schedule and know when each artefact will leave the live file and when it will leave the archive.

The right to erasure is recorded against the retention schedule rather than against silence. Where a client requests deletion of a record the firm is required to retain, the request is logged, the statutory ground for retention is recorded, and the client is told in writing which records cannot be deleted and why. The file does not delete and does not refuse without showing the ground.

Data minimisation runs through the engagement. The file collects only the records the documentation work needs, redacts unrelated personal data where a record contains more than the engagement requires, and stores the original and the redacted copy separately so the redaction is itself auditable. Minimisation is treated as a structural rule, not a one-time judgement at intake.

Counterparty reviewers care because a documentation file delivered to a bank, registrar or counsel is itself a data transfer. The file records the recipient, the date, the lawful basis for the transfer and the retention the recipient is asked to apply. A reviewer who sees those entries reads the deliverable as a file produced under a discipline they can audit, not as a bundle handed over informally.

DC-SERVICES does not provide data-protection advice, does not act as a data protection officer for clients, and does not claim certification under any data-protection standard. The work is documentation: record the basis, set the retention, minimise the data, log the transfers, honour the rights inside the statutory perimeter, and deliver a file in which the data lifecycle is as visible as the findings it contains.