Data retention- ex staff and students

[ITGuyNW]

Hi all

 

I'm looking at the schools data retention policies before speaking to our data officer at some point after half term.

 

I see generally schools are going for 12-14 months for emails. What do you do with personal data such as SIMS and documents such as word etc held on the servers in school once staff and students leave?

 

For example, once a teacher leaves, do you delete all accounts and associative data straight away but leave SIMS for a longer period?

[synaesthesia]

This is where you need to speak to your DPO first. Records on your MIS would be retained for 6 years minimum (or is it 7? Evades me), but some information including SEN and safeguarding is 25 years.

[jthompson]

I'm not an expert in this by any means, but as I understand it from discussions with our data manager, some things need to be retained until an individual reaches a certain age, rather than imply for X years after they leave the school. Probably not much difference for most in practice, but worth noting the distinction.

 

Regarding staff emails/files, the retention period for those may depend on the role(s) they've held.

[pete]

Our is based on the IRMS Toolkit for schools, with amendments for exam regulations and specific local stuff that doesn't fit neatly into existing sections of the toolkit (such as IT log retention).

 

Where there isn't a legal or regulatory minimum/maximum, you look at operational requirements and pick something reasonable, for example:

 

Administration of medicine to students

 

• Why do we keep this data? So staff know that Bob in 7B had 2 paracetamol today already at 11am and to record the authorisation from parents about the administration of not-prescribed medicine. Or (conversely) so we know Sarah in 8G refused to take her prescribed medicine for X and we need to inform parents.
  
• How long is the information useful for? Maximum 1yr. Use case is proof of authorisation, prevent overdosing and having data for medical staff should it be necessary in an emergency.
  
• What do we record? Date, time, student name, medication, dosage, any pertinent notes (parent authorising paracetamol, for example).
  
• Where is it recorded? (Spreadsheet)
  

[Face-Man]

The DFE have produced this set of guidelines for school re data retention an GDPR etc. This is for whoever is the data manager in the school to implement.

 

https://www.gov.uk/guidance/data-protection-in-schools/data-retention

 

Enfield council have produced this document outlining examples of how long certain data should be retained (can be in paper form not necessarily as electronic data)

 

https://traded.enfield.gov.uk/public-assets/attach/6495/Data-Retention-Policy.pdf

 

If your school subcribes to "The Key" this might help as well

 

https://schoolleaders.thekeysupport.com/administration-and-management/record-keeping/retention-records/gdpr-retaining-and-disposing-records/

[ITGuyNW]

Just revisiting this, what about actual files on a fileserver? For example, Year 11 student just left still has all their school work on the network such as one slide powerpoints and random jpegs.

[thimon]

Just revisiting this, what about actual files on a fileserver? For example, Year 11 student just left still has all their school work on the network such as one slide powerpoints and random jpegs.

 

Students who leave us have their accounts deleted (not just disabled) after 3 months, now that Microsoft have changed how they charge for storage - we don’t have a file server, OneDrive for user files. Our backup system allows a years worth of retention, however after that their files are fully gone.

[enjay]

What training do you provide staff to ensure they don't just flag everything as 'do not delete' or export their PST files "just in case I need it in the future"? In my experience, teachers are known hoarders! In fairness, quite a few times (including earlier today!) I've had to go back to an old email which I wouldn't have thought I'd need again so wouldn't have flagged at the time.

[markberry]

This is where you need to speak to your DPO first. Records on your MIS would be retained for 6 years minimum (or is it 7? Evades me), but some information including SEN and safeguarding is 25 years.

 

It's generally DOB + 25 years for student records. CP information held separately to the pupil file is DOB+25 years then review, so you may have to keep those files for longer.

 

There are a whole load of different timescales for staff information, H&S etc. Staff file is termination of employement + 6 years, Time sheets is current year + 6 years, Management of the Teachers’ Pension Scheme is Date of Last Payment + 6 years.

 

The school should have a Data Retention Scheme in place. The Information and Records Management Society have an Academies Toolkit which covers this. You can view the pdf for free on their site but need to be a member to download it. https://irms.org.uk/page/AcademiesToolkit

[markberry]

Just revisiting this, what about actual files on a fileserver? For example, Year 11 student just left still has all their school work on the network such as one slide powerpoints and random jpegs.

 

You need to check with your exams officer to see how long it needs be kept in case of appeals for exams etc. You may be asked for copies of coursework or other work as evidence so need to keep it to cover those timescales.

[Gibbo]

Just revisiting this, what about actual files on a fileserver? For example, Year 11 student just left still has all their school work on the network such as one slide powerpoints and random jpegs.

 

I keep ours for two years after they've left. Should be long enough for them to lodge any appeal about a final grade.

 

I 7ZIP the year group and archive off the main file server so its not still being backed up.

[enjay]

I keep ours for two years after they've left. Should be long enough for them to lodge any appeal about a final grade.

 

If that's the only reason you're keeping them, you can ditch them quicker - the appeals deadline in the autumn of the exam year, possibly as early as September.

 

Do you keep their Google Drive / OneDrive as well, and if so, for how long?