The personal data that schools hold – and probably should not

Schools are responsible for a lot of different types of personal data, whether it relates to pupils or employees.

Here we give some guidance on personal data in schools, why you may have it and how long you should be keeping it for. Once the time comes, data needs to be disposed of safely and in the right way.

Download a copy of Personal data that schools hold – and probably should not (PDF)

Types of personal data in schools

DBS certificates

• Provided to you by an employee when joining the school.
• Once the required background checks have been carried out, the purpose for obtaining the information has been achieved. Schools do not have to keep copies of DBS certificates. The certificate should be destroyed after a suitable period has passed – usually no longer than six months.

Emergency contact details

• Kept on the employee’s data file when they were employed.
• If an employee leaves, only certain data should be kept for more than a few months e.g. to provide references or to address pension arrangements. Emergency contact details are unlikely to be required further. Some personal information should be retained for six years from termination.

Applications for job vacancies

• Through recruitment where an applicant applies for a role.
• Unsuccessful applications should not usually be kept on the file beyond six months’ from conclusion of the recruitment process. There may be circumstances where there is a clear business reason for retaining their data beyond six months or if they have agreed for their details to be kept on file for future vacancies. For successful applicants, this can be kept on their personal file for no more than six years following termination of employment.

Bank details

• Kept on file for payment/finance purposes to pay employees.
• Should be deleted as soon as possible once final payments have been made.

Visitor books and signing in sheets

• To understand who has entered the school in order to protect staff and pupils.
• This should only be kept for that academic year, plus the six years following as a maximum.

Child protection files

• To record safeguarding concerns.
• These are to be destroyed once the child reaches the age of 25.

Allegations around concerns of an adult’s conduct around children

• To maintain records relating to certain adults regarding concerning behaviour and protection of children.
• If these allegations are found to be malicious this record should be destroyed immediately. However, malicious is not the same as unsubstantiated. Disciplinary proceedings involving the safeguarding of children should be kept until the related adult reaches normal pension age or for 10 years from the date of the allegation, whichever is longer. This applies even if the allegation is unsubstantiated.

Pupil files in primary schools – education record

• A record of the pupil’s personal information and data.
• This should only be retained for the time which the pupil remains at the primary school. Transfer to the secondary or other primary school when the child leaves.

Pupil files in secondary schools – education record

• A record of the pupil’s personal information and data.
• This should be destroyed once the former pupil reaches the age of 22 – unless child protection applies then this should be 25. For some SEN files a longer retention period may be justified. Any decision should be documented.

Examination results

• Recording pupils’ results for the children and for the school’s statistical information.
• To be destroyed once six years has passed following the academic year they were created.

Pupils with Special Educational Needs records

• A record of the pupil’s personal information and date, with extra information regarding their additional needs.
• This should be transferred once the pupil moves from a primary school to another school (primary or secondary). In senior school, this should be kept until the child reaches the age of 22 and then should be destroyed – unless child protection applies in which case this should be when they reach the age of 25.

Accident reporting for staff

• A record of any accidents within the workplace.
• This should be destroyed after six years following the accident.

Accident reporting for pupils

•  A record of any accidents involving pupils.
• This should be kept for 25 years from the date of birth of the child.

Further support

For further advice or guidance on anything data or education sector related, contact our education specialist Louise Brenlund.

This content is correct at time of publication