Data Retention in Schools – Your Key to Unlocking Effective Data Breach Management

A robust data retention policy is a school’s most effective tool for minimising the impact of a data breach. While cyberattacks often make headlines, official ICO figures show that 86% of reported data security breaches in the education sector are actually non-cyber.

With most incidents stemming from internal errors like unauthorised access or emailing data to the wrong person, tightening data retention in schools can significantly minimise the impact of data breaches. By refining your data breach management, you can protect your school and trust from unnecessary regulatory scrutiny and avoidable UK GDPR fines.

What is Data Retention in Schools?

Data retention is defined by three core pillars: how long data is kept, where and how it is stored, and when and how it is securely deleted.

Schools hold and generate a vast volume of records. Establishing clear policies guarantees that vital information is accessible, secure, and eventually disposed of in a timely and proper manner. The risk of a breach or misuse rises the longer the data is retained, which proper retention strategies help minimise. In doing so, schools can stay compliant with UK GDPR principles, specifically accountability, storage limitation, and security.

During our sofa session, we surveyed our audience and found that 70% of respondents' schools have a formal data retention policy and schedule. Meanwhile, 12% stated they do not, and 18% were unsure. While having documented policies is a great first step, it is not the final one; ensuring everyone understands the importance of data retention and follows these schedules is equally vital. We will explore this, along with other key areas of data retention, in the sections below.

How Can Your School Best Prepare for a Data Breach? The Building Blocks of Data Retention

Data retention is not just about storage, it is about control, visibility, and accountability. Here are the four key building blocks to having an effective data retention process and strategy.

Retention Policy

This is your formal document. It outlines retention periods, responsibilities, and deletion procedures.

It should also clearly lay out where the responsibility for monitoring retention lies, who can authorise deletions, and how you can ensure deletions happen. Without proper and well-documented policies, data retention becomes inconsistent and reactive.

Retention Schedule

Not all data is equal and thus should not be treated as such.

Whether it is pupil records, safeguarding files, HR records or emails, different types of information are governed by specific statutory retention periods. A retention schedule sets out those timelines clearly.

This also helps prevent you from falling into the trap of “keeping the data just in case”, which often is where risks start creeping in.

Oversight and Accountability

Policies are only effective if they are followed. There should be:

• Regular reviews of retained data
• Clear responsibility placed on certain members of staff, for example IT and SLT
• Updates to all staff when legislation or guidance changes

Data Mapping

You need to know where your data sits. It was great to see that the majority of our audience are, to some extent, confident about knowing all the systems where personal data is stored. Having a data map can certainly increase that confidence level and give you better visibility on your data overall.

Data mapping, in essence, is a way of documenting the types of personal data the school holds, where it is stored, and how it is used. That includes data on your MIS, but also those on cloud systems, email platforms, backup systems, and third-party software.

A third-party data-sharing register is imperative, it provides full visibility on which suppliers hold specific data, allowing for a rapid response should a breach occur.

If you do not have a data map in place, your DPO would be able to help you get started. Judicium also provides DPO services, including a data mapping tool on our Jedu platform which streamlines the process by enabling schools to create data maps with ease. 

The Risks of Over-retention

From supporting schools through an average of 42 data breach cases each week, we see first-hand how the volume of retained data determines the severity of an incident. Simply put, data you no longer need is data you no longer need to protect.

If a cyber-attack hit today, would the scale of the breach be limited to current records, or would years of historical data be at risk? While more than half of our audience believe they would know the approximate extent of a breach, an alarming third admitted they would not know what data would be affected in face of attacks without a significant investigation. Whether you have a rough idea or are entirely unsure, now is the time to review your policies and eliminate risks of over-retention. 

Over-retention is not just a compliance risk; it complicates every stage of a crisis. The more surplus data you store, the longer it will take you to locate vital information, respond to Subject Access Requests, or accurately identify what has been exposed, all while the ICO’s 72-hour reporting deadline is counting down.

Strong Data Retention Practices Make Breach Management Much Easier

With a clear data map, controlled storage locations, defined retention periods and limited legacy data, you will be able to better manage data breaches if and when they happen.

When dealing with a data breach, you will need to quickly assess the impact of the breach, isolate affected systems, report to the ICO within the 72-hour regulatory timeframe and communicate clearly with impacted individuals if necessary. This is why having clean, well-structured, and properly retained data is key.

In other words, retention is preventative breach management.

At the end of the day, we understand that every school's situation and the challenges they face are different, whether it is with email retention, legacy files, or something else. Therefore, having a dedicated DPO who can advise and offer bespoke support is invaluable. From keeping you up-to-date with the latest legal updates, to providing your team with the right training, and everything in between, our Data Protection Services are designed specifically for schools and MATs, to offer you peace of mind.