MIS Data Retention

[Gongalong]

Hi folks,

 

I'm looking at MIS data retention.

 

We keep physical copies of student records for 7 years, and child protection records for 60+ years - I'm double checking these figures as part of the review.

 

There doesn't seem to be any need to keep MIS data after students have left, but what are other schools doing?

 

Thanks

[enjay]

I'd keep the MIS data for the 7 years, or at least for 2 or 3, as people often need to access historic information on students and it would be tedious to do this from paper each time.

 

There's a longer retention on some SEN records too, I believe.

[Gongalong]

We were thinking of keeping for at least one, because we need to contact leavers and our comms system is linked in with SIMS. It's a difficult one because we infrequently get requests from ex-students to confirm they were at the school, although some are so long ago they predate SIMS. It would be nice to help, but if the law requires the data is deleted...

[enjay]

It would be nice to help, but if the law requires the data is deleted...

 

The law doesn't require it to be deleted, the law says you must keep it for 7 years and as long thereafter as you need it, once you no longer need it you must delete it (if you can). If you can justify keeping basic start and end dates, you can do so. You think schools like Eton are deleting all student history after 7 years?!

 

Being able to verify the dates of attendance is a reasonable use of the data, but it would be harder to justify their daily attendance, absences, late marks, etc. so keep the admission date and date of leaving in MIS, but delete daily attendance.

Edited January 17, 2025 by enjay

[Gongalong]

I suppose a middle ground would be to export a basic roll for the academic year and store that.

[Ditto]

The law doesn't require it to be deleted, the law says you must keep it for 7 years and as long thereafter as you need it, once you no longer need it you must delete it (if you can). If you can justify keeping basic start and end dates, you can do so. You think schools like Eton are deleting all student history after 7 years?!

 

Being able to verify the dates of attendance is a reasonable use of the data, but it would be harder to justify their daily attendance, absences, late marks, etc. so keep the admission date and date of leaving in MIS, but delete daily attendance.

 

On the law saying you need to keep for 7 years, could you point me in the direction of the legislative act that states that. The reason I ask, is because although I do not currently work in a school, we work with a lot of school data, but also have some overlap with medical data. We have a lot of special category, lots of very sensitive safe-guarding data. I've found it very hard to find clear guidance, especially linking back to legal requirements. Having that link would help. I would also add this should not an IT driven policy. It needs to be a school/trust leadership/DPO policy with governor sign off. IT are then the people who work to meet the policy requirements for digital records - remember most schools will have paper and other records and this should be dealt with under the same policy.

[enjay]

On the law saying you need to keep for 7 years, could you point me in the direction of the legislative act that states that.

 

Try https://www.gov.uk/guidance/data-protection-in-schools/record-keeping-and-management#:~:text=Secondary%20school%20pupil,pupil%E2%80%99s%2025th%20birthday as a starting point. This says we should keep it until the person's 25th birthday, which is why schools often work to 7 years. There are other dates for SEN and safeguarding information. Apparently we should keep record of child protection allegations against staff until their retirement age, which could be 45 years.

 

Oddly, a few rows further down, it says we should keep attendance information until the subject is 30, so I'm not sure how both those dates can co-exist! It's also a little odd that primaries only need to keep data until the child leaves the school, but secondaries apparently have to keep it until 25 even if the person leaves mid-phase.

[Ditto]

Try https://www.gov.uk/guidance/data-protection-in-schools/record-keeping-and-management#:~:text=Secondary%20school%20pupil,pupil%E2%80%99s%2025th%20birthday as a starting point. This says we should keep it until the person's 25th birthday, which is why schools often work to 7 years. There are other dates for SEN and safeguarding information. Apparently we should keep record of child protection allegations against staff until their retirement age, which could be 45 years.

 

Oddly, a few rows further down, it says we should keep attendance information until the subject is 30, so I'm not sure how both those dates can co-exist! It's also a little odd that primaries only need to keep data until the child leaves the school, but secondaries apparently have to keep it until 25 even if the person leaves mid-phase.

@enjay, this topic has come up again in another thread. I came looking for this post as I recall it being the first time I'd seen specific dates - and I am sure saw them mentioned at the time. When I follow the link you posted at the time, I'm sure I saw the 25th and 30th birthday's mentioned. I can't see them now. Have I lost it! Have you lost it! Have we both lost it!!!! Or have DfE mucked things up, either previously or now?

[enjay]

It definitely did say 25th birthday, my link was one of those Chrome "link to highlighted text" things. Curiously, the page says it hasn't been changed since December, but I posted the above in February. The guidance has become a bit woolier now, passing the responsibility on to us to decide (pasting the text below in case the page changes again!):

 

Your data retention policy should explain how long you need to keep information. It should set out:

 

why you are holding this data

your justification for keeping the data

the lawful basis for processing and keeping the data

if you will pass this data on and, if so, if you need to keep it once you have passed it on

the steps you will take when you destroy any personal data

A good data retention policy includes how long you will keep data items within the different areas of school administration. For example, you may need to keep pupil names in your safeguarding system longer than in your catering system.

 

The DfE page goes on to say our data retention policy should meet Ofsted's requirements, so maybe that's the next place to check.

[Ditto]

Phew! Must be the DfE that has lost it! I'd always felt the guidance, wherever I looked was woolly and had always hope the DfE would one day give some clear guidance on real figures to work to. I reckon they did that and someone pulled the plug. Over time (decade?) I've tried DfE, Ofsted, ICO and because my work overlaps, with medical guidance from DHSC. At no point did I come across really clear black and white guidance which is why your link with specific ages struck such a chord with me. Oh well!

[enjay]

Phew! Must be the DfE that has lost it! I'd always felt the guidance, wherever I looked was woolly and had always hope the DfE would one day give some clear guidance on real figures to work to. I reckon they did that and someone pulled the plug. Over time (decade?) I've tried DfE, Ofsted, ICO and because my work overlaps, with medical guidance from DHSC. At no point did I come across really clear black and white guidance which is why your link with specific ages struck such a chord with me. Oh well!

 

I've only ever seen guidance not rules (other than what I linked to earlier, of course!), and you can't see the IRMS stuff without paying now either.

[slugshead]

https://www.jisc.ac.uk/guides/records-retention-management

 

This is pretty comprehensive...

[Marci]

A whole section has gone from the page... 22nd January, it had a subsection called "Create a Retention Schedule" with detailed guidance...

 

[Ditto]

A whole section has gone from the page... 22nd January, it had a subsection called "Create a Retention Schedule" with detailed guidance...

 

[ATTACH=CONFIG]73282[/ATTACH]

Is that from Webarchive? You have wonder why it was removed. We could really benefit from this sort of advice. The JISC linki is useful background reading but it is aimed at tertiary educations. A primary school, secondary and 6th form guide etc. would help many?

[Marci]

Nope - from my email sent items where I’d quoted and screenshotted it to our DPO.

[enjay]

You have wonder why it was removed. We could really benefit from this sort of advice.

 

Quietly removed too, because the "page updated" date wasn't changed.

[Marci]

Quietly removed too, because the "page updated" date wasn't changed.

 

Look at the meta headers in source… that gives the *actual* generated updated dates rather than the person-typed ones visible on the page.

[robintech]

They've put it back now, Secondary school pupil records    Until the pupil’s 25th birthday.

 

20 March 2025published amendments, Hide

Record keeping and management

Guidance has been added to help create a data retention schedule.

[Marci]

Now that  looks more like what I was expecting it to say way back when I originally stumbled over it... rather than a fixed age of 30.

Now:


Before the disappearance:

[GrumbleDook]

IIRC some of the guidance they used was taken from the IRMS toolkit, which was written for members.