School data retention: making a workable schedule

Organise the schedule around records and purposes

Begin with record types, not a list of applications. A pupil's name may appear in admissions, safeguarding, catering and a trip list, but each record serves a different purpose. The same retention period should not automatically apply to every occurrence of the name.

Department for Education record-management guidance for schools explains the need to justify retention and distinguish legal requirements from operational needs. Schools should set their schedule with the appropriate records and data-protection advice for their nation, status and circumstances. This guide deliberately avoids presenting one universal number of years for all school data.

Build a useful inventory

Ask teams where they create, receive, use and store records. Include the MIS, email, shared drives, finance services, parent systems, paper files, local downloads and cloud applications. Look for recurring exports that continue to accumulate after their immediate purpose has ended.

For each record group, identify its owner, purpose, location and sensitivity. Note whether another organisation is the appropriate long-term holder. A migration project or contract renewal is a useful opportunity to verify the inventory, but routine reviews should not depend on a major system change happening.

Define the trigger as well as the period

A period is ambiguous without a starting event. It might run from the creation of a record, the end of a financial year, the end of an employment relationship or another specified event. Define that trigger clearly and identify the system field or process that supplies it.

Schedule field	Why it matters
Record group	Prevents unrelated documents being treated alike
Purpose and authority	Explains why the school keeps the record
Retention trigger	Identifies when the clock starts
Period or review rule	States when action is due
Responsible role	Gives someone ownership of the decision
Final action	Distinguishes deletion, transfer, archival and further review
Exceptions	Records how holds or disputes affect routine disposal

Have the relevant lead approve the schedule. Do not invent a convenient period solely because the software offers that setting.

Distinguish a live record from an archive

Information that must be retained does not necessarily need to remain available in every live application. A leaver may need an appropriately restricted historical record without an active account in a parent app. Consider whether a controlled archive meets the purpose with less exposure and lower operational complexity.

An archive should still have an owner, access controls and a way to retrieve necessary records. A folder of unexplained exports is not a reliable archive. Test whether staff can locate the right record and understand its dates, relationships and attachments without depending on an old supplier account.

Include duplicates, exports and supplier copies

Deleting a record in one application may leave copies in downloads, email attachments, reports or connected systems. Identify the routine flows and decide how each copy is handled. Where staff create a temporary working export, specify the working location and disposal point.

Ask suppliers what deletion means in their service. Clarify whether it affects active records, attachments, replicas and retained backups, and what evidence is available. Align the contract exit process with the school's schedule. A statement that an account has closed is not the same as confirmation that all applicable deletion or transfer steps have occurred.

Treat backups and holds explicitly

Backups exist to recover systems; they should not become an undocumented alternative archive. Understand the backup retention cycle, who can restore data and how information previously deleted from live systems is handled if an older backup is restored. Agree the process with IT support and the relevant data-protection lead.

Routine disposal may need to pause for a complaint, investigation, legal requirement or another authorised hold. Staff need to know who can issue a hold, what it covers and when it is reviewed. Do not let an informal instruction to keep everything indefinitely replace a properly scoped decision.

Make disposal an ordinary controlled task

Schedule reviews at manageable intervals and produce an action list for the responsible people. Check a sample before enabling large automated deletions. Use an approval and evidence process proportionate to the records and the risk, with suitable separation of duties where practical.

Keep an appropriate disposal record without reproducing all the personal data that was deleted. The record should explain the category, authority, date and method of action. Staff training should cover everyday copies as well as major archives, because old downloads and attachments can outlast the system that created them.

Revisit the schedule when work changes

Review retention when a service is introduced, a contract ends, guidance changes or a new purpose is proposed. Ask whether the actual configuration still matches the approved schedule. The aim is a defensible, usable routine that retains necessary evidence and removes information that no longer has a justified purpose. The school data migration guide explains how to apply these decisions during a system change.