Picture this: You’re clearing out a dusty old cupboard in the staffroom and stumble across a stack of paper files labelled “Year 11 – 2009”. A mix of test scores, behavioural logs, and, oddly, a permission slip for a trip to Alton Towers.
Your first thought? How did this survive the last clear-out?
Your second? Should we even still have this?
If you’ve ever found yourself asking those questions, you’re not alone. But when it comes to managing personal data in schools, it’s not just about tidiness or storage space, it’s about legal responsibility, privacy, and respect for the individuals behind the information.
Let’s talk about data retention, and why getting it right is more than just best practice, it’s the law.
Data Isn’t Just Data. It’s Someone’s Life Story
In education, we collect a lot of data: names, addresses, medical notes, academic records, safeguarding files, staff performance reviews, you name it. And it all serves a purpose… for a time.
But once that purpose is fulfilled? Keeping it longer than necessary can be a breach of the UK GDPR and Data Protection Act 2018 (DPA).
The GDPR (General Data Protection Regulation), still part of UK law post-Brexit, tells us that personal data must be:
- Accurate
- Kept up to date
- Not kept longer than necessary
In other words: Just because you have it, doesn’t mean you should still keep it.
“Just In Case” Isn’t a Policy
One of the most common phrases you’ll hear in schools when asking why old data still exists is:
“We might need it one day.” But the law says otherwise.
Every piece of personal data must have a defined retention period based on its purpose. These periods should be recorded in your data retention policy or information asset register, which should be reviewed regularly.
Let’s look at a few examples:
- Safeguarding records? Kept until the child is 25 (or 6 years after the last entry if the child was not looked after).
- Recruitment records for unsuccessful applicants? Typically 6 months.
- Staff employment files? Usually retained for 6 years after employment ends.
These timeframes aren’t arbitrary. They’re based on legal, educational, and best practice guidance (such as from the IRMS toolkit for schools).
Imagine if a former pupil, now 30, asked for all the information you still held about them. Could you confidently justify why you still have that Year 8 report from 2006?
Or worse, what if their data was part of a breach and it turned out it should have been deleted a decade ago?
This isn’t just theoretical. Schools have been fined for poor data management practices, including keeping data for far longer than necessary.
So what can schools do to stay compliant and responsible?
Have a Clear Retention Schedule
Refer to sector-specific guidance (like the IRMS Records Management Toolkit) and document retention periods in your data protection policy.
Build a Culture of Data Hygiene
Make data deletion as routine as fire drills. Annual “digital spring cleans” can be helpful for reminding staff to review and remove old files.
Use Technology Wisely
Modern MIS and HR systems often allow automated data archiving or deletion after a set period. Use these tools, but make sure they’re configured correctly.
Train Your Staff
Teachers and admin staff are on the frontlines of data processing. Make sure everyone knows why data retention matters—and what they’re responsible for.
Final Thoughts: Respecting the Past Without Hoarding It
Data retention might not be the most glamorous part of running a school, but it is one of the most important for protecting your pupils, your staff, and your reputation.
Ultimately, it comes down to this: Respect the data as you would respect the person it belongs to.
You wouldn’t keep old student essays or report cards pinned to a noticeboard for years, so why keep their digital (or paper) equivalents indefinitely?
Managing data well isn’t just about compliance, it’s about ethics, trust, and good governance.
So next time you come across a file from five headteachers ago, ask yourself: Why do we still have this? And if there’s no good answer, it might be time to let it go.
