Skip to content
Made in the UK

SIEM for MSPs

How long should MSPs retain security logs in the UK?

By , CTO, CybaVerse. Last reviewed

There is no single UK legal retention period for security logs. MSPs should set a written policy per client that keeps logs long enough to investigate incidents, which are often found weeks or months later, while respecting UK GDPR storage limitation, sector rules and contracts. Review the policy at least yearly.

This page is part of our SIEM for MSPs guide.

What do UK rules and guidance say about log retention?

UK GDPR requires that personal data is kept no longer than necessary, and logs often contain personal data such as user names and IP addresses. The NCSC's logging guidance encourages organisations to decide retention based on what they need to investigate. Sector regulators and contracts may add specific requirements.

  • UK GDPR storage limitation applies to logs containing personal data.
  • NCSC guidance ties retention to investigation needs.
  • Sector rules and client contracts can set minimums.

How should an MSP set a retention policy, step by step?

A good policy is specific by log type and by client, written down and agreed. The steps below help MSPs justify each period, which matters both for investigations and for data protection. Document the reasoning, because the ICO expects organisations to be able to explain why they keep data.

  1. Step 1: List log types per client

    Identity, endpoint, email, firewall and cloud logs have different value and volume.

  2. Step 2: Note legal and contractual requirements

    Record any sector or contract minimums for each client.

  3. Step 3: Decide investigation needs

    Consider how long incidents typically take to discover in that environment.

  4. Step 4: Set and document periods

    Write the period for each log type and the reason for it.

  5. Step 5: Review yearly

    Revisit when regulations, contracts or client risk change.

What factors push retention longer or shorter?

Retention is a trade-off between investigation value, privacy and cost. The table summarises the main factors MSPs weigh for each client. Use it to explain your recommendation, rather than quoting a single figure for every client and every log type, which rarely suits everyone.

FactorPushes retentionWhy
Slow breach discoveryLongerEvidence must still exist when found
Personal data in logsShorterUK GDPR storage limitation
Sector or contract rulesLongerMinimum periods may apply
Storage costShorterVolume grows with retention

Where does CybaOps fit for log retention?

CybaOps offers configurable retention, so MSPs can match each client's agreed policy rather than one global setting. Agree retention with each client when you set terms, and record the decision alongside the client's other security policies so it can be reviewed every year.

  • CybaOps offers configurable retention.
  • CybaOps collects security logs from endpoints, firewalls, cloud and Microsoft 365 into one place.
  • CybaOps normalises security data to the open OCSF schema.
  • Analysts and partners can search and investigate across their data in CybaOps, with AI help to build queries.
  • CybaVerse is a UK cyber security company with a UK-based SOC.

Log retention

How long to keep logs: a written policy per client

There is no single UK legal retention period for security logs.

01 Log sources

Multi-tenantPartner / MSP CustomerCustomerCustomer+
CybaOps by CybaVerse

Log retention

02 The 5-step path

  • Role-based access
  • UK-based analysts
  • ISO 27001

03 Outcomes

Explore

Hover or tap any part of the diagram to see what it does.

  • SIEM in
  • CybaOne

What else do MSPs ask about log retention?

Is there a minimum period for Cyber Essentials?

Cyber Essentials does not set a log retention period. Check the current requirements document for each assessment. Set retention based on the client's legal, contractual and insurance needs instead, and record the agreed period in writing.

Should we keep everything forever?

No. Keeping personal data longer than necessary conflicts with UK GDPR storage limitation. Set a retention period that balances investigation needs with data protection, document the reasons for it and make sure older logs are deleted when that period ends.

Who decides the period, the MSP or the client?

The client is usually the data controller, so agree the policy with them in writing. The MSP can advise on what is practical for investigations, but the client should approve the final retention period and review it when their needs change.

What should you do next?

  1. List which clients already send logs anywhere, and who reads them today.
  2. Pick two clients to start with and agree what good looks like.
  3. Book a CybaOps demo to see the workflow on real data.

See CybaOps | Become a CybaVerse partner

Related: How do MSPs run a SIEM without a 24/7 SOC? and What is OCSF and why does it matter for MSP log normalisation?

See the workflow on real data.

Book a CybaOps demo