File retention policy

Does anyone have a file retention policy they'd be willing to share? We recently had an issue with a "Subject Access Request" from a previous church member requiring us to send him all personal data that we have on file for him from a period 12-14 years ago. It turns out that we have caused ourselves problems by having retained rather too many documents. On the other hand there are good reasons for us to have retained some for some time. So knowing what other churches do would be most helpful please.  Simon Jones