Data Retention Guidelines for Schools

Why retention matters

Schools hold a lot of personal data. UK GDPR says you should keep it only as long as you need it, but some records must be kept for set periods. A clear retention policy helps you do both, and tells you how long your backups need to keep older copies.

Typical categories of records

• Pupil records: including attendance, assessment and safeguarding information
• Staff records: including contracts, payroll and personnel files
• Financial records: accounts, purchasing and grant information
• Governance: minutes, policies and complaints
• Email and communications

Where to find the rules

Retention periods vary by record type and are set out in official guidance. Schools commonly refer to guidance from the Department for Education and sector bodies such as the Information and Records Management Society. Always check the current guidance and take advice from your data protection officer before setting periods.

How backups fit in

• Decide which systems hold which records
• Set a backup retention period for each that matches your policy
• Remember that backups also contain personal data and fall under the same rules
• Delete data you no longer need, including from old backups, when the policy says so

Practical tips

• Write the policy down and review it every year
• Keep a record of who approved it
• Make sure leavers’ data is covered
• Test that you can retrieve an old record when asked

This guide is general information, not legal advice. Our education backup service is designed for schools, colleges and trusts.