ARC's retention policy is one sentence, and it is worth reading exactly as written rather than paraphrased:

"Retain, never hard-delete. Records held about a child are retained per the schedule below; a deletion is a reversible soft-delete (the row is kept), and the safeguarding case record is immutable. Automated purging is out of scope for v1."

That sentence is the policy the software implements. This article explains which parts of it are mechanism and which parts are documentation, because the difference matters if you are answering a data question.

Deleting does not delete

Every child-scoped record type in ARC meets the never-hard-delete guarantee in one of two ways:

It soft-deletes. A "delete" writes a timestamp on the row. The row itself stays in the database, and the deletion is reversible. Most record types work this way — incidents, plans, journals, logs, documents, photos, ledger entries and the rest.

It has no delete path at all. Placements, safeguarding concerns and risk assessments are kept as immutable history. There is no delete to soft-delete.

This is not a claim taken on trust: a test walks the schedule and asserts that every type marked as soft-deleting genuinely carries the soft-delete behaviour, and that every type documented as immutable history genuinely does not. A change that quietly turned a delete into a real delete would fail the build.

The schedule

Alongside the mechanism, ARC holds an explicit, published map of record type to retention basis — the reason each type is kept and for how long. A few examples of what it says:

Record type	Basis as recorded
Daily journals and daily logs	Daily care record (Reg 36) — retain until the child turns 75
Safeguarding concerns	Immutable, retain indefinitely (IICSA minimum 75 years)
Physical interventions	Restraint record (Reg 35) — retain until the child turns 75
Complaints (Reg 39)	Retain min. 3 years; held on the case record
Ledger (incentives and finances)	Financial record — retain min. 6 years
Activities, appointments, rewards	Retain for the life of the placement

You can read the whole schedule inside ARC: it is printed at the bottom of every Subject Access export, on screen and in the PDF.

What the schedule is not

It is not a clock. Nothing in ARC counts down a retention period, and nothing deletes a record when one elapses. The code says so in as many words: the periods are "documentation, not an enforcement clock", and automated purging is explicitly out of scope for this version.

So if the question is "will ARC dispose of this record when the time comes?", the answer today is no. ARC keeps it, and records why it is being kept. Disposal remains a decision your organisation makes.

Where the schedule stops

The schedule covers the record types held about a child — the same set the Subject Access export compiles, kept deliberately in lock-step so that no exported section can exist without a documented basis. A test enforces that too.

Records outside that set are not on this schedule. Reports are versioned and retained rather than hard-deleted, but their basis is not written down here.

Corrections leave the original in place

Retention is only half of it. Records that are reviewed, submitted or signed off are versioned: an edit is a new version, not an overwrite. A correction is a further entry, and the original stays visible with its timestamp and author — which is what makes the history worth anything when someone asks about it two years later.