Connecting an AI assistant to business folders does not make those folders well governed. Old customer files, duplicated spreadsheets and forgotten scans may contain information that no longer serves a clear purpose. Before giving a new tool access, establish what you hold and why.

Good records management is not a one-off clear-out. It is a repeatable process for keeping necessary information available, limiting access and disposing of records responsibly when they are no longer needed.

Map the records you actually hold

Start with a simple information-asset register. Include paper archives, email, shared drives, cloud services, backup arrangements and retired equipment. Record the owner, purpose, sensitivity and location of each category. Include prompts and AI-generated outputs if your team stores them as business records.

Give records consistent names and classifications. This makes them easier to retrieve, review and dispose of, and helps avoid importing unrelated or confidential material into a new AI workflow.

Set retention periods by purpose, not guesswork

UK data-protection law does not set one universal retention period for every type of personal data. ICO guidance says organisations should justify their periods, review holdings and erase or anonymise information when it is no longer needed.

Other obligations may require you to keep particular records. Check applicable legal, contractual and regulatory requirements, and preserve records needed for ongoing disputes or investigations. An AI project is not a reason to bypass those requirements or keep everything indefinitely “just in case”.

Minimise what an AI tool can access

A business assistant used to draft product descriptions is unlikely to need payroll files or customer complaints. Define the purpose and give it access only to the relevant approved material. Review the source folders before connecting them; a copy of an old archive can carry the same personal-data risks as the original.

ICO's AI audit guidance recommends checking that personal data is adequate, relevant and limited to the purpose, and reviewing retention during development. Treat anonymisation or synthetic data as options to assess, not automatic privacy guarantees.

Keep access tied to the job

Assign access according to roles and review it when staff join, move or leave. Remove unnecessary permissions rather than assuming everyone should see everything. Where an AI system retrieves internal records, test that its configuration respects the access boundaries intended for each user.

Restrict access to paper files and devices awaiting disposal as well. Data protection does not stop at the edge of a shared drive.

Make disposal traceable

Review before deletion. Confirm the retention decision and check for preservation requirements.
Address all relevant locations. Include duplicate files, downloaded exports, paper copies and applicable backup arrangements. If immediate deletion is not possible, assess appropriate access restrictions and documented handling.
Use suitable disposal methods. Confidential paper and digital storage need different processes. Record who authorised disposal and retain appropriate evidence.
Repeat the review. Assign an owner and schedule the next check so unwanted data does not accumulate again.

For confidential paper that has reached the end of its justified retention period, explore our shredding and collection services. For retired storage devices, read our guide to old hard drives. Contact us to discuss your requirements.

Sources and further reading

Published 3 November 2026. General information, not legal advice. ICO AI guidance is under review following the Data (Use and Access) Act 2025. Cover image is AI-generated and illustrative.

Less Data, Lower Risk: Managing Business Records in the AI Era