How long should a security policy containing rules for employees be retained?

ANSWER

As one of the documents making up a functioning data protection system in an organisation, the security policy should remain in force without interruption. Of course, personal data protection documentation, including the security policy, should be reviewed periodically, e.g. once a year, for correctness and updated where necessary.