Personal information retention and deletion policy

Purpose

This policy sets out how [school name] determines how long personal information is retained, how information is deleted or disposed of when the retention period ends, how exceptions are recorded, and how retention rules are kept current.

Scope

This policy applies where the school uses and retains personal information. It covers the personal information held in the school’s records and information systems.

Policy requirements

The school should maintain a documented retention and deletion policy for the personal information it uses. Personal information should not be kept for longer than needed.

The school should maintain a retention schedule covering the relevant school records. The schedule should state the retention period for each relevant record category and identify what should happen when that period ends.

The school should maintain documented deletion or disposal processes. Those processes should identify the information covered, the point at which retention ends, the authorised method of deletion or disposal, and the role responsible for carrying it out.

Responsibilities

The policy owner is [policy owner role]. The policy owner is responsible for maintaining this policy and the retention schedule, coordinating updates, and ensuring that exceptions are recorded.

The role responsible for approving retention exceptions is [exception approver role]. Operational teams should follow the retention schedule and the documented deletion or disposal processes for the information they manage.

Retention decisions

Retention periods should be recorded in the retention schedule rather than decided informally for individual records. Each decision should identify the record category, the applicable retention period, and the action required when retention ends.

Where the school identifies a need to retain information beyond the period in the retention schedule, the reason, affected record category, revised end point, and approving role should be recorded as an exception.

Deletion and disposal

When the retention period ends, the school should follow the documented deletion or disposal process for the relevant record category. The process should be applied to the information covered by the retention schedule and should identify any action required for the information system in which it is held.

An exception must be recorded before information is retained beyond its scheduled period. The record should state the reason for the exception, the information concerned, the approving role, and the date on which the exception is to be reconsidered.

Subject access requests

The school should use the retention schedule and deletion records to support searches for personal information when responding to a subject access request. Applying the retention and deletion policy may reduce the amount of information that needs to be reviewed and can help searches focus on information that should still be retained.

Keeping the policy current

The policy owner should keep this policy, the retention schedule, and the documented deletion or disposal processes current. The next review should be initiated when [retention review trigger] occurs.

Approved exceptions

Approved exceptions must be recorded in [exception record location]. The record must be available to the policy owner and the role responsible for approving retention exceptions.