Retention Periods

[gmonks]

Hi guys,

 

Hoping I can have some advice.

 

What are the retention periods you use for retaining staff documents / emails once they've left?

 

I can't seem to find any general guidance (I know DfE is working on some) and the LEA aren't able to give any either.

 

Any advice would be greatly appreciated.

Edited October 31, 2018 by gmonks

[djrscally]

I think most folks are following some adaptation of the IRMS retention schedule, which is on Page 37 of this document:

 

https://cdn.ymaws.com/irms.site-ym.com/resource/collection/8BCEF755-0353-4F66-9877-CCDA4BFEEAC4/2016_IRMS_Toolkit_for_Schools_v5_Master.pdf

[gmonks]

I think most folks are following some adaptation of the IRMS retention schedule, which is on Page 37 of this document:

 

https://cdn.ymaws.com/irms.site-ym.com/resource/collection/8BCEF755-0353-4F66-9877-CCDA4BFEEAC4/2016_IRMS_Toolkit_for_Schools_v5_Master.pdf

 

Thank you, I had previously read this but wasn't sure if it was still what people were using as it was published in 2016 and pre-GDPR.

[GrumbleDook]

It was pre-GDPR, but that shouldn’t matter too much. The legislation involved in needing the emails hasn’t really changed,

 

There will be an update out early next year but you should be able to work with it as it is.

[gmonks]

It was pre-GDPR, but that shouldn’t matter too much. The legislation involved in needing the emails hasn’t really changed,

 

There will be an update out early next year but you should be able to work with it as it is.

 

Thank you both.

[gmonks]

It was pre-GDPR, but that shouldn’t matter too much. The legislation involved in needing the emails hasn’t really changed,

 

There will be an update out early next year but you should be able to work with it as it is.

 

I was looking at the toolkit posted, (link) but I can't see anything about retention periods for staff emails (once they've left) nor staff documents (once they've left) is there any guidance on this?

[AlanD]

Given that many of the legal cases that now get taken on go back decades I see no reason to delete or destroy records. Such data might be required to establish work histories, which classes and students that taught etc. Yes, access to such records should be locked down with no possibility of changing or amending them. Staff records don't actually take much space, so I see no reason to delete them as they represent what is believed to be a true record of their time at a school. Yes, I have seen suggestions that student records should be kept until they are 25, but there is no legal reason why this should not be (much) longer or indeed shorter. Historically paper records were kept in school often going back decades, and unlike paper records, computer records can be secured and access to them locked down making computer records rather safer to keep.

[jthompson]

I have seen suggestions that student records should be kept until they are 25, but there is no legal reason why this should not be (much) longer or indeed shorter. Historically paper records were kept in school often going back decades, and unlike paper records, computer records can be secured and access to them locked down making computer records rather safer to keep.

 

I'd argue that data minimisation plays a part here. Retaining pupil records indefinitely doesn't sound like it tallies with the reasons they were originally used.

[GrumbleDook]

There will an update to the IRMS toolkit early next year and it will help cover this for you. Several EG members have committed personal time on it so we will update you as soon as we can.

[gmonks]

There will an update to the IRMS toolkit early next year and it will help cover this for you. Several EG members have committed personal time on it so we will update you as soon as we can.

 

Thank you.

[PotNoodleTech]

I hope we can get some clarification on this. Clearly staff information like attendance/etc recorded in SIMS needs to be kept for a much longer period than stuff in their my documents.

 

Personally, if they don't take a copy of their own my documents before the leave, they clearly don't see it as important. I don't see why I should have to store/control/baby sit it for the next 10+ years. It's like not clearing out your desk before you leave, you wouldn't leave all your personal photos of your family and your favourite plant then comeback 10 years later and expect the company to have kept it in storage for you!

[jthompson]

Personally, if they don't take a copy of their own my documents before the leave, they clearly don't see it as important.

 

They may not know that they need/want it right away. Some ex-pupils come back to us requesting work from a certain project or other, perhaps within a year or two of having left. Also, teaching staff may occasionally want something from a previous year as exemplar material.

[GrumbleDook]

There is a difference between what is required to be kept by legislation (the IRMS Toolkit is fantastic to help with that) and what you thing *should* be kept as it is operationally useful, is helpful to former student / staff or needs to be looked at for transfer to your School Archive. The DfE Data Protection Toolkit explains that in a bit more detail as it discusses data minimisation (the example of a picture being blurred over time).

 

When considering staff emails, depending on the system you use you can specify retention periods that differ depending on location / tags / etc. I'd be interested if any members are doing this.

 

It's also important to remember that Records Management is about Classification ... know what you've got and where it fits in ... you *must* put relevant information in the *relevant* system, no matter if it came in by email, post, phone message, carrier pigeon (including RFC2549) ... that way you can keep mailboxes 'clean' and info in the right place.

 

It used to be easier when we had limited space in mailboxes ... but now many people use it as the storage itself.

[synaesthesia]

carrier pigeon (including RFC2549) ... that way you can keep mailboxes 'clean' and info in the right place.

 

 

I've learned something today! And now, for some reason, I have visions of General Melchett screaming in my ear about shooting his Speckled Jim.

[clangstaffnhts]

@GrumbleDook we are currently investigating the automatic deletion/retention of emails within Office 365.

 

Although just in the testing phase at the moment I think we will most likely look at a 3-5 year turnover (5 would take us to the lifespan of a student at the school) for staff emails allowing staff to go back and find emails that may still be useful or relevant and unless categorised for a specific purpose they will then be deleted at the end of the time period.

 

We're taking the stance that if an email contains important info such as Safeguarding data that we are required to keep by law a record of this should be kept within the designated Safeguarding system (CPOMS in our case) and then it doesn't matter that the communication has been deleted from the email platform.

[simpsonj]

Interesting thread.

At present, when staff leave, I delete their Office 365 account, which has a default 30 day grace period. Is this long enough, or should I be disabling the account for a set period of time instead, then deleting?

[Sonic007]

We delete all mail after 3 years.

[aarono]

Interesting thread.

At present, when staff leave, I delete their Office 365 account, which has a default 30 day grace period. Is this long enough, or should I be disabling the account for a set period of time instead, then deleting?

 

When staff leave here their 365 account gets blocked which, as simpsonj correctly says, by default gives a 30 days grace before permanently deleting the mailbox. However, this is not ideal for us and until we confirm a retention period for mailboxes I manually run these commands:

• get-Mailbox -ResultSize Unlimited | Set-Mailbox -LitigationHoldEnabled $true

• get-Mailbox -ResultSize Unlimited -Filter {RecipientTypeDetails -eq "UserMailbox"} | Set-Mailbox -LitigationHoldEnabled $true

https://docs.microsoft.com/en-gb/office365/SecurityCompliance/place-a-mailbox-on-litigation-hold

 

As regards to student work, a letter is sent to all students with a notice that they can appeal any marks/grades by 20th September and that work will be destroyed from December. Currently we keep student IT work for a year. I am not sure from a data protection point of view how long student work should be kept, but if it is not needed by the school then there is no need to keep it.

[Face-Man]

As well as the very useful IMRS document you might find the spreadsheet "02-2. Schools Retention Schedule" here https://www.hackneyservicesforschools.co.uk/extranet/gdpr may be useful as it outlines the retention period and what the legislation applies. Though keeping school pupil record for 25 years could be interesting, anybody dust off the floppy drive....

 

It is also slight ironic that a GDPR service with a first page that lists the restrictions on distribution of the documents has them put on a public website

[AndrewSharp]

A survey of HR professionals suggests that a third have not yet implemented their retention policy so now hold data in breach of their company policies.

 

HR could be exposing firms to potential GDPR fines | theHRDIRECTOR

 

Give your shredder an end of term workout and ditch any HR paperwork past the designated retention date.