What is data retention?

The storage limitation principle in UK GDPR says personal data should be kept only for as long as you need it for the purpose you collected it for. Some records have legal minimums. For example, schools in England must keep every entry in their attendance and admission registers for six years from the date it was made. Other periods come from guidance, insurance, safeguarding needs or limitation periods for legal claims.

Many schools base their retention schedule on sector guidance, such as the Information and Records Management Society (IRMS) toolkit for schools. Safeguarding records often need to be kept for much longer than general records, and you should not delete information that may be relevant to an ongoing inquiry or investigation.

Why it matters for your setting

• Keeping data too long increases the risk and impact of a data breach, while deleting it too soon can harm pupils or leave you unable to answer questions later.
• A clear retention schedule makes subject access requests and audits easier.
• Commissioners may want to know how long you keep the information they share with you, and what happens to it when a placement ends.

How PupilDB helps

PupilDB holds pupil and staff records in one system, so you know where the data is when you apply your retention schedule, rather than tracking copies across spreadsheets and inboxes.