Data protection in schools

Department for Education update: March. 2025

The Department for Education recently updated its guidance on record keeping and management. The Data Protection Act 2018 and UK GDPR mandate that data retention should only be for as long as needed. You should check what data you hold each year and whether you still need to keep it.

To help with this yearly audit, "it’s important to put in place policies and processes so you can prove and evidence that you’re not keeping data for longer than necessary."

In this article, we explore the proposed update and the steps you should be paying attention to. 

Creating your data protection policies and processes

1. Develop a data retention policy

Your data retention policy should clearly detail how long your school and colleagues should keep information. It should include information on: 

➡️ Why are you holding that particular data?

➡️ The justification for holding that data.

➡️ What are the laws/regulations around holding that data 

➡️ Will you ever be required to pass this data on, and if so, will you still need to keep a record?

➡️ The protocol and steps for deleting/erasing personal data.

"A good data retention policy includes how long you will keep data items within the different areas of school administration. For example, you may need to keep pupil names in your safeguarding system longer than in your catering system."

The more detailed and regularly updated you can keep your policy; the easier it will be for you and your colleagues to adhere to laws and statutory guidance. It will also help reduce the worrying! 

2. Carry out a personal data audit

In this most recent update, as of March 2025, the DfE reiterates a key message: you should not keep data for longer than you need to. 

The best way to do this is to get up close and personal with all of the personal data you store. Knowing the data sources, locations, and justifications for having that personal data means you can stay on top of your obligations for that data. 

As part of the audit, include pupil and staff data in:

📍Paper records

📍Databases

📍Online systems

📍Videos and photos

There are then four key actions that you will need to perform with your data based on your audit findings.

1️⃣ Keep data  2️⃣ Destroy data 3️⃣ Change - paper to digital 4️⃣ Keep for research/litigation

The DfE then clearly detail a set of example categories for your data to make it easier for you and the rest of your school leaders to understand the audit you have created.

Example categories:

🔒 Admissions
🔒 Attainment
🔒 Attendance
🔒 Behaviour
🔒 Exclusions
🔒 Personal identifiers, contacts and pupil characteristics
🔒 Identity management and authentication
🔒 Catering and free school meal management
🔒 Trips and activities
🔒 Medical information and administration (psst. we can help here 🙌)
🔒 Safeguarding/special educational needs

"Share the results of your audit with your school leaders, governors and trustees. They are responsible for ensuring the school complies with the Data Protection Act 2018 and only keeps the data it needs."

3. Depersonalise personal data

The older data becomes, there are steps you can take to move the data out of the:

'We actively need to know this.' ➡️ 'Just in case we need this' category.

For instance, before deleting the data completely, remove names and personal identifiers. For example, once the pupil has left your school, you could remove their name and date of birth. This will remove some of the risks concerning personal data. It will also allow you to use it for long-term analysis of trends.

Another option is to replace the personal identifiers with non-personal identifiers. For example:
Replace 'Name' with a random ID/character ID identifier.
Replace DoB with YoB
Replace the postcode with their town name

4. Dispose of personal data

"When records have reached the end of their retention period, data must be disposed of securely and confidentially. The ICO has guidance on practical methods for destroying records that are no longer needed."

Do not dispose of records with the regular waste or in a skip.

- Shred paper records using a cross-cutting shredder.
- Destroy storage media and hard disks to particles no larger than 6mm.
- Dismantle and shred audio and video tapes.

The Freedom of Information Act 2000 mandates that you maintain a list of records that have been destroyed and who authorised their destruction. You must have approval from a senior leader for the record to be destroyed.

You must document the destruction. Record a brief description of the data and shred the records as soon as you’ve documented them as being destroyed.

5. Create a data retention schedule

Once you generate your data retention policy in step 1, it is good practice to create a data retention schedule. This should state how long you’ll hold certain types of personal data before destroying it.

Download the PDF below, which details the statutory retention periods for different types of data. You should decide how long to keep other records according to your school's business needs.

6. Compliance and review of your retention policy

Once you have a retention schedule in place, you should ensure your staff are trained in the secure and timely disposal of records.

You should conduct yearly audits of your retention schedule and regularly review your policies to ensure compliance with legislative changes.