Records Retention

General guidance on records’ retention

One of the data protection principles requires that personal data is retained for no longer than is necessary for the purpose or purposes for which it is obtained.

This requirement places a responsibility on schools/ETBs as data controllers to be clear about the length of time for which data will be kept and the reason why the information is being retained.  It is a key requirement of data protection legislation that personal data collected for one purpose cannot be retained once that initial purpose has ceased.   Equally, as long as personal data is retained, the full obligations of the Acts attach to it. 

Schools/ETBs should have:

  • A defined policy on retention periods for all items of personal data kept 
  • Management, clerical and computer procedures in place to implement such a policy
  • Schools/ETBs should assign specific responsibility to someone for ensuring that files are regularly purged safely and securely and that personal information is not retained any longer than necessary. This can include appropriate anonymisation of personal data after a defined period if there is a need to retain non-personal data. Anonymisation must be irrevocable and the removing of names/addresses may not necessarily be sufficient
  • Importantly, certain legislation prescribes a statutory minimum retention period.  It is important that schools/ETBs are mindful of these as minimum requirements. 

Records Retention Schedule

Records retention schedule is being worked on. Please contact you management body for an update.

The responsibility for ensuring that data are kept for appropriate periods rests with the Board of Management (or in the case of an ETB school, with the ETB). The Board of Management (or employer for ETB schools) must have a clear, transparent and compelling justification for retaining each class of data for a specified period. Remember retaining on a ‘just in case’ basis is not acceptable. If a school considers that it is reasonably foreseeable that litigation/legal proceedings will be brought against the school/ETB in respect of a particular issue, they should not delete the data relating to that issue and should obtain legal advice.