Subcontractors and suppliers are responsible for complying with the legal and regulatory record retention requirements that apply to their own businesses. Where they process personal data or manage records on behalf of another organisation, contracts should clearly define responsibilities for storing, retaining, and securely disposing of information in accordance with applicable legislation.


