Contents

 

1. INTRODUCTION.. 2
2. PURPOSE. 2
3. SCOPE OF THE POLICY. 2
4. ROLES AND RESPONSIBILITIES. 2
5. PRINCIPLES OF RETENTION AND DISPOSAL. 4
6. SECURE DATA STORAGE. 5
7. BACKUP AND DISASTER RECOVERY. 5
8. DATA RETENTION SCHEDULE. 5
9. SECURE DATA DISPOSAL. 6
10. DATA DISPOSAL PROCEDURES. 6
11. ARCHIVING OF PERSONAL DATA.. 6
12. PERIODIC AUDITs 7
13. MONITORING, REVIEW and ENFORCEMENT. 8

APPENDIX 1: DATA RETENTION AND DISPOSAL SCHEDULE. 9

APPENDIX 2: DATA DISPOSAL PROCEDURE. 13

APPENDIIX 3: DEFINITIONS. 14

 

1.          INTRODUCTION

• The Data Protection Act, 2019 seeks to safeguard individuals from the misuse of personal data and protect their privacy. It regulates how organisations collect, use, disclose, retain and dispose of personal information to ensure responsible and accountable handling.

 

• NAS Airport Services Limited (NAS) collects and processes personal data from employees (current and former), outsourced employees, job applicants, directors, shareholders, suppliers, visitors, individual clients and other related parties. Such data includes, but is not limited to, identification details, contact information, financial data, biometrics data, health data, family details and other sensitive or confidential information necessary for legitimate business operations.
• This Data Retention and Disposal Policy provide guidelines for the secure retention, storage and disposal of personal data to ensure compliance with applicable laws, protect individual privacy and minimise the risk of unauthorised access or disclosure.

2.          PURPOSE

• This Policy is intended to ensure that all personal data processing carried out by, or on behalf of, NAS complies with the requirements of the Data Protection Act, 2019.

3.          SCOPE OF THE POLICY

• This Policy applies to all personal data collected, processed and stored by NAS, whether in physical or electronic form.
• It covers all personal and sensitive personal data relating to employees (current and former), outsourced employees, job applicants, directors, shareholders, suppliers, visitors, individual clients and other related parties whose data is collected in the course of NAS’s operations.
• The Policy applies to all NAS staff and contractors, including permanent, fixed-term and temporary, outsourced employees, consultants, interns and any third-party representatives involved in data processing activities.

 Compliance with this Policy is mandatory. Any breach shall be treated as misconduct and addressed in accordance with NAS’s disciplinary procedures.

 4.          ROLES AND RESPONSIBILITIES

• The Board of Directors
  • The Board provides strategic oversight and ensures that data protection and retention are integrated into NAS’s governance and risk management framework. It:
• Approves data protection and retention policies, frameworks and resources
• Ensures adequate financial, human and technical resources for compliance
• Monitors the implementation of data protection and retention initiatives by management
• Reviews reports from the DPO and Data Protection Committee on compliance status; and
• Promotes a culture of accountability, privacy and information governance across the organisation.

 

• Data Protection Committee
  • The Committee coordinates company-wide compliance efforts and ensures consistent data management practices. It:
• Develops and reviews data protection, retention and disposal guidelines
• Identifies and documents the types of data collected, processed and stored across departments
• Determines appropriate retention periods based on legal, regulatory and operational requirements
• Monitors compliance with the Data Protection Act and internal policies
• Reviews high-risk activities such as new products, vendor engagements and cross-border data transfers
• Advises management on risk mitigation and escalates significant issues to the General Manager and Board; and
• Ensures data is securely stored and protected during the retention period.
  • Data Protection Officer (DPO)
    • The DPO is the focal point for data protection and retention compliance. The DPO:
  • Acts as the primary contact with the Office of the Data Protection Commissioner (ODPC)
  • Monitors compliance with the Data Protection Act, regulations and internal policies
  • Conducts Data Protection Impact Assessments (DPIAs) for new products, systems and technologies
  • Provides training and awareness on data protection and retention obligations
  • Oversees data subject rights requests and breach response processes; and
  • Advises management on regulatory developments and best practices
    • The IT Department
      • The IT Department ensures that data retention and disposal are supported through appropriate technical controls. It:
    • Implements secure data archiving, backup and disposal systems;
    • Collaborates with data owners to identify, classify and protect data;
    • Securely deletes electronic data in accordance with approved methods and timelines; and
    • Regularly reviews and updates storage systems to align with retention requirements.
      • Employees:
        • All employees must handle personal data and company records responsibly. They are required to:
      • Abide by this Policy and all related data protection procedures;
      • Handle and store records securely to prevent loss, damage or unauthorised access.
      • Retain records only for approved business, legal or regulatory periods.
      • Follow approved disposal procedures for both physical and electronic data.
      • Ensure accuracy and completeness in recordkeeping; and
      • Promptly report any loss, damage or unauthorised disposal of records to the Records Officer or DPO.

5.          PRINCIPLES OF RETENTION AND DISPOSAL

• NAS shall retain personal data for as long as may be reasonably necessary to satisfy the purposes for which it is processed unless the retention is:

• Required or authorised by law;
• Reasonably necessary for a lawful purpose;
• Authorised or consented by the data subject; or
• For historical, statistical, journalistic literature and art or research purposes.
• NAS shall maintain a Data Retention Schedule specifying appropriate time limits for each category of data. Periodic reviews shall be conducted to determine whether continued storage is necessary.
• Upon expiry of the retention period or the fulfilment of purpose, personal data shall be securely erased, deleted, anonymised or pseudonymised, in accordance with the approved Data Disposal Procedures.

 

6.          SECURE DATA STORAGE

• NAS shall store all personal and company data in a secure manner that preserves its confidentiality, integrity and availability throughout its lifecycle.
• All physical records shall be stored in locked cabinets or restricted-access areas, accessible only to authorised personnel and protected from loss, theft, fire or environmental damage.
• Electronic records shall be stored in secure systems protected by access controls, encryption and authentication measures, regularly backed up to prevent data loss; and protected through appropriate technical controls.
• Access to personal data shall be granted strictly on a need-to-know basis and reviewed periodically to prevent unauthorised access or misuse.
• The IT Department shall implement appropriate technical and organisational measures to ensure that storage systems comply with NAS’s Data Retention and Disposal Policy and the requirements of the Data Protection Act, 2019.

7.          BACKUP AND DISASTER RECOVERY

• NAS shall maintain regular, secure backups of personal and company data in line with the Company’s Information Security Policy.
• All backups shall be encrypted and stored securely both onsite and offsite, or within approved cloud environments and ensure the same level of protection as the primary data.
• The backup and recovery processes shall be periodically tested to verify their effectiveness and ensure business continuity in the event of data loss, system failure or disaster.

 

8.          DATA RETENTION SCHEDULE

• NAS maintains a Data Retention Schedule that defines the retention periods for different categories of records based on legal and regulatory requirements, business and operational needs and the purposes for which the personal was collected.
• The Data Retention Schedule shall be reviewed periodically to ensure continued compliance with the Data Protection Act, 2019 and other applicable laws.
• Upon expiry of the prescribed retention period, the relevant data shall be securely disposed of in accordance with this Policy and the approved Data Disposal Procedures.

 

9.           SECURE DATA DISPOSAL

• NAS shall ensure that all personal and company data is securely disposed of once it is no longer required for business, legal or regulatory purposes, in accordance with the approved Data Retention Schedule by ensuring:
• Disposal methods are appropriate to the format and sensitivity of the data and shall prevent reconstruction, retrieval or unauthorised access of data.
• Physical records are disposed of through approved methods such as shredding, pulping or incineration under the supervision of the Records Officer or an authorised representative.
• Electronic records are permanently deleted or overwritten using secure deletion tools or other approved sanitisation methods to ensure that the data cannot be recovered.
• Where disposal is carried out by a third-party service provider, NAS shall ensure that:
• The provider is contractually bound to follow secure disposal standards
• A certificate of destruction or equivalent documentation is obtained; and
• The process is verified and documented for audit and accountability purposes.
• All disposal activities shall be logged and reviewed periodically to confirm compliance with the Data Retention and Disposal Policy and the Data Protection Act, 2019.

 

10.         DATA DISPOSAL PROCEDURES

• All data disposal activities shall be conducted in accordance with Appendix 2 – Secure Data Disposal Procedures.
• The procedures outline approved methods for the secure destruction, anonymisation or sanitisation of personal and company data once the retention period has lapsed or the purpose of processing has been fulfilled.
• The procedures apply to both physical and electronic records.
• The Records Officer shall oversee the implementation of these procedures, in consultation with the Data Protection Officer and the IT Department.

11.        ARCHIVING OF PERSONAL DATA

• NAS shall ensure that personal data which is no longer actively used but must be retained for legal, regulatory, security or business purposes is securely archived in accordance with this Policy and the Data Retention Schedule (Appendix 1).
• Archived data shall be:
• Clearly identified and separated from active records to prevent unauthorised access or alteration.
• Stored in secure, access-controlled environments, including:
  • locked filing cabinets or restricted records rooms for physical files
  • Encrypted servers, dedicated archive folders, or restricted document management systems for electronic files
• Protected by layered security measures, such as:
• Encryption of files and drives
• Password protection and multi-factor authentication for system access
• Audit trails or access logs to monitor user activity
• Regular vulnerability scans and patch updates; and
• Secure off-site or cloud backups with equivalent protection standards.
• CCTV surveillance footage collected for security and safety purposes shall be securely stored, accessed only by authorised personnel and retained for the minimum period necessary—typically not exceeding 60 days, unless required for investigations, legal proceedings, or regulatory reasons. After this period, footage shall be automatically overwritten or securely deleted.
• Access to archived data, including CCTV footage, shall be restricted to authorised personnel only, based on operational or legal necessity.
• The Records Officer, in consultation with the Data Protection Officer and IT Department, shall ensure that:
• Archiving processes are documented, approved and periodically reviewed;
• Archived data remains retrievable during the retention period; and
• Data is assessed periodically to determine whether it should be retained, anonymised or securely disposed of.
• Archived data shall not be repurposed or reused for new purposes unless such processing complies with the Data Protection Act, 2019, including identifying a lawful basis and issuing a new privacy notice where required.

12.        PERIODIC AUDITS

• NAS shall conduct periodic audits of its data retention, storage, archiving and disposal practices to ensure continued compliance with the Data Protection Act, 2019, this Policy and internal data management procedures.
• The audits shall be coordinated by the Data Protection Officer (DPO) in collaboration with the Records Officer, IT Department and relevant functional heads.
• Each audit shall assess:
• Adherence to the Data Retention Schedule and Disposal Procedures.
• The effectiveness of storage, archiving and access control measures.
• Documentation and traceability of data disposal activities; and
• Compliance with legal and regulatory obligations relating to data protection.
  • Findings from each audit shall be documented and shared with management, along with corrective actions, timelines and recommendations for continuous improvement.
• Any identified non-compliance or data protection risk shall be promptly addressed and follow-up reviews shall be conducted to verify the implementation of corrective measures.

 

13.        MONITORING, REVIEW & ENFORCEMENT

• The implementation of this Policy shall be monitored continuously by the Data Protection Officer (DPO), in collaboration with the Records Officer, IT Department, the Data Protection Committee and other relevant departments, to ensure ongoing compliance with the Data Protection Act, 2019 and related regulations.
• This Policy shall be reviewed at least once every two years, or earlier where there are:

changes in the law or regulatory requirements, significant organisational, technological, or operational changes; or recommendations arising from audits, compliance assessments, or incidents.

• Updates to the Data Retention Schedule and Data Disposal Procedures may be made as operational needs evolve, subject to approval by the Data Protection Officer and relevant senior management.
• Failure by any employee, outsourced employee, or third-party representative to comply with this Policy or related procedures shall be treated as a serious compliance breach and may result in disciplinary action, termination of engagement, or other appropriate legal or administrative measures.
• The Board of Directors shall receive periodic reports from the DPO on policy implementation, audit outcomes and any material compliance risks identified, to ensure continued governance oversight.
• Any questions about this Policy should be referred to the Company’s Data Protection Officer (DPO) at [email protected]

 

 

APPENDIX 1: DATA RETENTION AND DISPOSAL SCHEDULE

Data Subjects	Data Collected	Retention Period	Justification	Disposal Measures
Job Applicants	·       Applicants’ personal information (e.g.,Name, ID, address, contact details ) ·       Application documents (e.g., CV, cover Letter) ·       Employment history and references ·       Academic and professional documents ·       Background checks ·       Pre-employment health checks ·       Family Medical history	3 years from the date of application	o   Recruitment record keeping o   Verification of information o   Future job opportunities o   Legal or complaint handling o   Compliance and audit purposes o   Fit for work checks	o   Secure deletion such as overwriting and anonymisation o   Degaussing, physical destruction o   Shredding, incineration or pulping.
Employees	§  Contact details: Telephone numbers, Personal email and Postal address. §  Recruitment data: Work history, Academic certificates, Interview notes, CVs, Cover letters, Information contained in the interview score sheets, Police clearance certificates, References from former employers, Psychometric tests results. §  Onboarding data: Contract or letters of offer, Statutory documents such as NSSF, SHIF, KRA PIN, Bank details, Passport photos. §  Employee Records: Employee personal data forms, Consent to use personal data form, Staff registers, Payroll and Employee benefits records, Transfer and promotion records, Salary review records, Performance management records, Disciplinary records, Leave records, Training records, Health records, Payroll and employee benefits records, Employee signatures, Communication with employees in form of emails, phone calls, letters. §  Health Data: Family medical history, medical checks, laboratory tests, Medical insurance information, On-site clinic visits information including name, statutory medical records; WIBA records, DOSH records. Internship records: Intern personal data sheets and internship evaluation forms.	§  Duration of employment at The Organization and 5 years thereafter for legal purposes §  For photographs and videos: For the duration of the consent. §  For cookies: refer to Cookie Policy. §  CCTV records: as per CCTV Policy.	o   Administration of contract o   Identification and verification o   Legal Compliance o   Health and Safety Compliance o   Legitimate interests o   Business requirements	o   Secure deletion such as overwriting, anonymization, degaussing, physical destruction o   Shredding, incineration or pulping. o   Or any other method as may be determined by The Organization from time to time.
Individual Clients	Clients’ personal (e.g., name, address, contact) ·       Invoices and receipts ·       Payment records ·       Compliance and regulatory documentation ·       Correspondence and communication records	3 years after a service/transaction	o   Business record keeping  and accountability o   Legal and regulatory compliance o   Audit and verification o   Dispute resolution o   Historical reference	o   Secure deletion such as overwriting and anonymisation o   Degaussing, physical destruction o   Shredding, incineration or pulping.
Third-party Service Providers	·       Third-party Service Providers Agreements Financial Records ·       Invoices and receipts ·       Payment records ·       Bank details ·       Tax and audit documentation ·       Financial statements	o   Termination date + 10 years	o   Legal claims o   Dispute resolution o   Auditing o   Regulatory and tax compliance o   Financial reporting o   Audit and verification o   Legal and dispute resolution o   Record keeping and accountability	o   Secure deletion such as overwriting and anonymisation o   Degaussing, physical destruction o   Shredding, incineration or pulping.
Outsourced Employees	·       Employee contracts ·       Employee personnel files (e.g., performance reviews, disciplinary actions) ·       Payroll records ·       Employee health and safety records ·       Pension and benefits records ·       Employee training records ·       Employee leave records (sick leave, maternity leave)	o   Termination date + 10 years	o   Legal protection, o   Managing employment disputes o   Compliance with tax laws o   Compliance with labor laws.
Visitors	·       Name and staff/visitor ID ·       Access card number ·       Airport pass number ·       CCTV footage and access logs ·       Date and time of entry/exit	o   1 year from date of record creation (CCTV footage: 30–90 days unless required for investigation)	o   Security monitoring and incident investigation o   Access verification and audit trail o   Regulatory and safety compliance	o   Automatic deletion or overwriting of access logs after retention period o   Secure erasure of digital records o   Shredding of physical access records or logs
Airline Representatives	·       ID Number ·       Staff Number ·       Airport Pass Number ·       CCTV Records	o   Termination date + 10 years o   CCTV records: as per CCTV Policy.	o   Access control and security verification o   Operational coordination o   Safety and incident investigation o   Legal and regulatory compliance	o   Secure deletion such as overwriting and anonymisation o   Degaussing, physical destruction o   Shredding, incineration or pulping.
Shareholder/Board of Directors	·       Board meeting minutes and resolutions ·       Directors’ contracts and service agreements ·       Director remuneration and benefits records ·       Conflict of interest declarations ·       Directors’ personal information (e.g., ID, address, tax information) ·       Financial and investment information	o   Termination date + 10 years	o   Corporate governance, o   Legal compliance o   Audits o   Historical records.	o   N/A
Marketing Models	·       Proof of consent for marketing purposes and audits. ·       Contact details (e.g., name, email, phone number) ·       Opt-in/opt-out requests	o   2 years after withdrawal of consent	o   Proof of consent for marketing purposes and audits. o   Marketing audit trail	o   Secure deletion such as overwriting and anonymisation o   Degaussing, physical destruction o   Shredding, incineration or pulping.
Suppliers	·       Contact details: phone number, email address, identification details: name, ID/Passport, KRA PIN, contract details ·       Third-party agreements (e.g., medical service providers) ·       Payment details: supplier statements, bank account details, ·       CCTV records ·       Complaints/requests	o   Termination date + 10 years o   For photographs and videos: for the duration of the consent o   CCTV records: as per CCTV Policy.	o   Legal claims, dispute resolution, o   Regulatory requirements.	o   Secure deletion such as overwriting and anonymisation o   Degaussing, physical destruction o   Shredding, incineration or pulping.
Office Visitors	·       contact details: phone number, ·       identification details: name, ID, Car registration number, ·       CCTV records ·       Complaints/requests	o   1 year o   CCTV records: as per CCTV Policy.	o   Security and incident investigation o   Data protection compliance o   Emergency management	o   Secure deletion such as overwriting and anonymisation o   Degaussing, physical destruction o   Shredding, incineration or pulping
Website Visitors	·       Name, Contact details i.e., phone number/email address, Online identifiers such as cookies and related tags, IP addresses	o   1 year	o   Legitimate Interest	o   As per the Terms and Conditions of the Website Privacy

 

 

APPENDIX 2: DATA DISPOSAL PROCEDURE

 

Type of Data	Format	Approved Disposal Method	Responsible Department / Officer	Verification / Documentation
Personal Data Files	Physical (paper)	Shredding or pulping under supervision	HR Officer	Certificate or disposal log signed by supervisor
Employee Records	Physical / Electronic	Shredding (physical), secure deletion (electronic)	HR Officer	Disposal log retained for 2 years
Financial Documents	Physical	Shredding or incineration	Finance	Certificate of destruction
Client Records	Electronic	Secure erasure or overwriting; verified deletion from backups	IT Department	Disposal report reviewed by DPO
Emails and Communications	Electronic	Permanent deletion from servers and devices	IT Department	Audit log confirmation
Media and Storage Devices	Hardware / Drives	Degaussing, secure wiping, or physical destruction	IT Department	Destruction certificate / witness record
Third-Party Disposals	Any	As per contract; certified by vendor	DPO / Procurement	Certificate of destruction retained

 

 

 

APPENDIX 3: DEFINITIONS

Data	all data that we hold or have control over and therefore to which this Policy applies. This includes physical data such as hard copy documents, contracts, notebooks, letters and invoices. It also includes electronic data such as emails, electronic documents, audio and video recordings and CCTV recordings. It applies to both personal data and non-personal data. In this Policy we refer to this information and these records collectively as “data”.
Data Protection Officer	the person within the organization who is responsible for advising on and monitoring compliance with data protection laws.
Data Retention Policy	this Policy, which explains our requirements to retain data and to dispose of data and provides guidance on appropriate data handling and disposal
Disposable information	disposable information consists of data that may be discarded or deleted at the discretion of the user once it has served its temporary useful purpose and/or data that may be safely destroyed because it is not a formal or official record as defined by this Policy and the Record Retention Schedule.
Non-personal data	data which does not identify living individuals, either because it is not about living individuals (for example financial records) or because it has been fully anonymized.
Personal data	any information identifying a living individual or information relating to a living individual that we can identify (directly or indirectly) from that data alone or in combination with other identifiers we possess or can reasonably access. This includes special categories of personal data such as property details and pseudonymized personal data but excludes anonymous data or data that has had the identity of an individual permanently removed. Personal data can be factual (for example, a name, email address, location or date of birth) or an opinion about that person’s actions or behaviour
Record Retention Schedule:	the schedule attached to this Policy which sets out retention periods for our formal or official records.
Storage limitation principle	data protection laws require us to retain personal data for no longer than is necessary for the purposes for which it is processed. This is referred to as the principle of storage limitation