Records Retention

General guidance on records’ retention

Rule 7 of the Data Protection Acts requires that personal data is retained for no longer than is necessary for the purpose or purposes for which it is obtained. See Rule 7: Retain it for no longer than is necessary for the purpose

This requirement places a responsibility on schools/ETBs as data controllers to be clear about the length of time for which data will be kept and the reason why the information is being retained.  It is a key requirement of data protection legislation that personal data collected for one purpose cannot be retained once that initial purpose has ceased. See Rule 2: Keep it only for one or more specified, explicit and lawful purposes.  Equally, as long as personal data is retained, the full obligations of the Acts attach to it. 

To comply with these rules, schools/ETBs should have:

  • A defined policy on retention periods for all items of personal data kept 
  • Management, clerical and computer procedures in place to implement such a policy
  • Schools/ETBs should assign specific responsibility to someone for ensuring that files are regularly purged safely and securely and that personal information is not retained any longer than necessary. This can include appropriate anonymisation of personal data after a defined period if there is a need to retain non-personal data. Anonymisation must be irrevocable and the removing of names/addresses may not necessarily be sufficient
  • Importantly, certain legislation prescribes a statutory minimum retention period.  It is important that schools/ETBs are mindful of these as minimum requirements. 

Records Retention Schedule

To assist schools, a template Records Retention Schedule of various types of records held by schools has been prepared which can be accessed by clicking on the following link Records Retention Schedule. The responsibility for ensuring that data are kept for appropriate periods rests with the Board of Management (or in the case of an ETB school, with the ETB). The Board of Management (or employer for ETB schools) must have a clear, transparent and compelling justification for retaining each class of data for a specified period. Remember retaining on a ‘just in case’ basis is not acceptable. If a school considers that it is reasonably foreseeable that litigation/legal proceedings will be brought against the school/ETB in respect of a particular issue, they should not delete the data relating to that issue and should obtain legal advice.