This is the general context that all NHS establishments MUST adhere to:

“All NHS records are public records under the terms of the Public Records Act 1958 sections 3 (1)–(2). The Secretary of State for Health and all NHS organisations have a duty under the Public Records Act to make arrangements for the safekeeping and eventual disposal of all types of their records. This is carried out under the overall guidance and supervision of the Keeper of Public Records, who is answerable to Parliament”.

This also applies in reality to most companies, after all you are handling OTHER PEOPLE’s information. Make sure the data you keep is secure, free from fraud and at the end of it’s life ensure a company such as Secure Data Recycling either deletes or shred’s your old data.