Consultant Data Handling Policy Template
Five documents and three sheets that turn a thirty-day destruction clause into a schedule with one row per copy of client data.
Free download · No account needed
Retention and Destruction Note · Alderton Reeve for Havenridge Retail Group · written 09 Apr, three weeks before the deadline
Three clocks, one set of copies
| Clock | What sets it | Date | Against the deadline |
|---|---|---|---|
| Contract | MSA 11.4, thirty days from termination on 31 Mar | 30 Apr | The deadline itself |
| Backup rotation | 30 dailies, 12 monthlies, 7 annuals, snapshots immutable | 31 Dec, six years out | 2,437 days after |
| Our own claim window | Work papers we could not answer a challenge without | 31 Mar, six years out | 2,162 days after |
19 datasets, 78 copies, 9 locations. 51 copies purge by the deadline, 19 are retained under the backup carve-out at clause 11.4(b) with the words quoted on every row, and 8 are conflicts: 4 work-paper extracts the clause has no limb for, and 4 on an associate’s laptop.
A certificate reading all Confidential Information has been destroyed is false from the day it is signed until the last annual snapshot rotates out.
Search this and page one hands you contracts. A mutual NDA, a confidentiality clause in the consulting agreement, a data processing agreement, and clause language for return or destruction on completion. The best result adds a real closeout checklist, which asks you to remove client data from all personal devices, cloud sync folders and email archives. That line cannot be ticked honestly, because ticking it requires an enumeration, and no template in the category ships one. This pack is the enumeration, built from what the intake pass already found.
So the unit here is the copy rather than the dataset. Alderton Reeve took 19 datasets from Havenridge Retail Group over a five-month depot network review. Those 19 existed as 78 copies across 9 locations: the workspace, two laptops, attachments inside email threads, a note-taking app, an internal deck, the work papers, an associate's laptop and the backup snapshots. Nineteen datasets is a sentence in a policy. Seventy-eight copies is a schedule of work, and 8 of those rows are things that cannot be done.
Three clocks then run on the same copies. The contract says 30 April, thirty days from termination. The rotation says 31 December six years later, because snapshots are immutable and the disposal rule itself excuses a case where targeted disposal is not reasonably feasible given how the data is held. The practice's own claim window says 31 March six years later, and that one is a floor rather than a ceiling. The spread is 2,437 days, which is how long a one-line certificate stays false.
What's in the pack
Data Register
One row per copy rather than per dataset, with the owner, the classification and the sanitization method actually reachable there.
Destruction Schedule
Every copy resolved to purge by the deadline, retain under a quoted carve-out with an end date, or conflict.
Access Log
One row per access event with the engagement reason, plus the four that matter more: grants, copies leaving, revocations and near misses.
How Three Clocks Disagree
Why the contract, your backup rotation and your own claim window produce three different dates on the same copy.
Data Handling Policy
The standing policy: allowed locations, four classification bands, access, subcontractors, incidents, and how retention actually works.
Client-specific Addendum
A one-page delta against the standing policy, including the requirements you cannot meet as written and what you do instead.
Retention and Destruction Note
The note that goes to the client three weeks early, naming each conflict with the options in the order you would prefer them.
Certificate of Destruction
Enumerated by disposition and reconciled to the register, following the per-media certificate the sanitization guidelines set out.
How to use it
- 1
Open in River, or take it blank
Open the pack in River and send the MSA, the security schedule and your own backup configuration, or download the Word documents and CSV sheets and fill them in yourself.
- 2
Census the copies
Walk the nine locations rather than working from memory, including the recycle bin, mailbox threads, and whatever a financial orientation pass copied out of the board pack.
- 3
Compute the three dates
Date the contractual clock from its trigger event, the way a restriction register does, then add the rotation date and your own retention floor.
- 4
Raise the conflicts, then certify
Send the note three weeks out so a client's legal team has time to answer in writing, then write the certificate from the schedule and reconcile the counts.
Frequently asked questions
Is this template free?
Yes. The zip is Word documents and CSV sheets, with no account and no card needed. Edit with AI is the other branch: it creates a free River account, installs this pack as a private Space, and starts filling it in from the contract and the file list you send.
What format are the downloaded files?
The five documents come as .docx and the three sheets as .csv, so they open in Word, Pages, Google Docs, Excel, Numbers and Sheets with no conversion. Add ?format=pdf to the download link if you want the documents as PDF for circulation instead.
What does Edit with AI actually do?
It reads the destruction clause and quotes it back with the trigger event, the period and the computed deadline. Then it builds the register from your own locations and file index, works out the three dates per copy, and marks the rows where the contract and your retention need cannot both be satisfied.
Why one row per copy instead of per dataset?
Because a dataset has one name and six destruction paths. The same extract sits in the workspace, on a laptop, inside an email thread, in a model, in a deck and in a snapshot, with a different owner and a different reachable date on each. The sanitization guidelines document per media for the same reason.
Can I certify destruction while backups still hold the data?
You can certify accurately, which is a different claim. The certificate here says what was sanitized, what is retained under the backup carve-out with the clause words quoted and an end date, and what is still outstanding. A blanket assertion would be false until the last snapshot rotates.
What about the personal data in what the client sent?
Transcripts, payroll extracts and headcount and rota data all count, and three of those usually arrive without anyone thinking of them that way. For those the choice between return and deletion is the client's rather than yours, and copies go unless a law requires them kept.
Does this replace the DPA or the confidentiality clause?
No. Those are contracts, and page one of this query is full of them. This pack is the handling procedure underneath: what arrived, where every copy went, what came off when, and the evidence you hand a security reviewer who asks about the clause you already signed.
Make the destruction clause an executable schedule
Take the Word documents and CSV sheets blank, or send River the MSA and your backup configuration and get the register, the three dates and the conflict list back.
Edit with AI