Record keeping in schools

Why schools need to keep records, and under which rules

Record keeping in schools is governed by three overlapping regimes, and most confusion comes from treating them as one.

Education law and statutory guidance. The Department for Education requires certain records to exist and to be maintained: the admission register and attendance register, the single central record of recruitment checks, and the pupil record itself. Academies and academy trusts have their own obligations through the funding agreement and the Academy Trust Handbook, which is why the DfE publishes separate record keeping and retention information for academies.

Data protection. UK GDPR and the Data Protection Act 2018 apply to every record containing personal data, which in a school is nearly all of them. The data protection principles do two things here that pull in opposite directions: they require personal information to be kept no longer than necessary, and they require it to be kept securely and accurately while you have it.

Freedom of information. Maintained schools and academies are both public authorities under the Freedom of Information Act 2000, so a member of the public can ask to access information the school holds and the school must respond within twenty school days, or sixty working days if that is sooner. The Environmental Information Regulations sit alongside it and cover anything about the school estate. That obligation is the practical reason a school needs to be able to find things, not merely to have them.

One more requirement sits across all three. Because a school is a public authority, UK GDPR requires it to appoint a data protection officer, and record management is squarely within that person's remit: advising on the retention schedule, monitoring compliance with the legislation, and being the contact point for the ICO. In a small school the role is often bought in, which works, provided the retention schedule is theirs to own rather than a document they were shown once.

A school that reads only the first regime keeps too much. One that reads only the second deletes things it needed. The retention schedule is where the three are reconciled.

What counts as a school record

It helps to sort records by who they are about, because that is what drives the retention period.

• Pupil records. The educational record and pupil file, admissions and appeals, attendance, assessment, special educational needs files, behaviour and exclusions, accidents involving a child, and safeguarding or child protection records, which are kept separately from the main pupil file
• Staff personnel records. Recruitment and the checks that feed the single central record, contracts, training, appraisal, absence, disciplinary and grievance material, and payroll
• Governance records. Governing body or trust board minutes and papers, policies and their review history, registers of interests, statutory policies, and correspondence with the DfE, ESFA or local authorities
• Operational and estates records. Health and safety, risk assessments, asbestos management, fire safety, contracts, and finance
• Information governance records. Your records management policy, the retention schedule itself, subject access requests and their outcomes, and any personal data breaches

Two categories are routinely missed. Safeguarding records are not part of the pupil file and follow their own rules on storage, transfer and retention. And the school's own decision making, the minutes and the correspondence, is a record in exactly the same sense as a pupil file, subject to freedom of information and often the first thing asked for.

For a practical school records checklist, choose one category above and record: its owner; where the authoritative copy lives; who can access it; the applicable source and jurisdiction; the retention trigger; the required action on transfer or disposal; and the last review date. Keep these labels together so that a deputy can apply the same decision.

How long schools must keep records

Different records have different retention rules. Start with the current DfE record-keeping guidance for schools in England, the rules for your school type and your approved retention schedule. Distinguish a legal requirement from a recommended period and document the purpose of anything retained longer.

Some important distinctions in the DfE guidance, checked in September 2026:

• Primary pupil files: transfer when the pupil leaves; DfE separately advises retaining MIS data for two terms.
• Secondary pupil files: retain until the pupil’s 25th birthday, transferring the record if they change school.
• Child protection files: keep separately and transfer securely. DfE specifies the 25th birthday, or the 75th birthday for files relating to child sexual abuse.
• Staff allegations: these need their own safeguarding retention decision, not the ordinary personnel-file rule. Apply current KCSIE, including its distinctions between allegation outcomes.
• Admissions and attendance registers: consult the School Attendance (Pupil Registration) (England) Regulations 2024; these are distinct from the pupil file.
• Governance and estates: use the applicable record category and authority. Do not apply one permanent-retention or forty-year rule to every set of minutes or asbestos document.

A useful retention schedule records the category, source, trigger, period, responsible role and final action. “Twenty-five years” is unusable without saying whether the clock starts at birth, departure or the last entry. Keep the date of your source check beside the rule so that a later reviewer can see which edition was used.

The ICO retention principle requires a justifiable purpose and review of personal data. A recommended period is not permission to keep every duplicate indefinitely, nor is an automatic deletion date a reason to destroy records relevant to a live case. Resolve legal holds, safeguarding needs and any public-interest archiving arrangements before disposal.

Use the latest relevant Information and Records Management Society toolkit and local authority schedule as supporting references. An academy trust should also check the DfE academy retention guidance. They are not substitutes for identifying which rule applies to the particular document.

Storing, scanning and finding records

The question schools ask most often is whether to scan or to store. There is no legal preference: a scanned record is admissible and acceptable provided the scanning process is documented, the copy is complete and legible, and the school can show the digital version has not been altered.

Scanning earns its cost where records are requested often and stored where they are not. Pupil files carrying pupil information that must transfer when a child moves school, and safeguarding records holding sensitive information that may be needed at speed, are the strongest candidates. Boxes of finance records that nobody will open before disposal are the weakest, and professional document storage is usually cheaper than scanning them. Sorting by types of documents rather than by age is what makes that decision cheap: a document management review that starts with the archive tends to stall in it.

Both routes can be compliant, and educational institutions run a mixture in practice. Whichever route, three controls do the work. Records must be held in secure storage, whether that is a live system, a parent portal or an archive, with access limited to those who need it. Information management in schools fails most often at this point rather than at the retention schedule. There must be a log of what exists and where, because a freedom of information request or a subject access request is answered from the log rather than from memory. And personal information must be protected against loss and unauthorised alteration, which for digital records means backups and an audit trail, and for paper means a locked room rather than a cupboard in a corridor.

Disposal of records means one of two things, and a retention schedule should say which. Most records are destroyed. A small number have historical value beyond the school, and the right disposal for those is transfer to an archive rather than the shredder: admission registers, log books and governing body minutes are what a county record office typically wants, and it will usually say so if asked. Disposal in either form must wait in specific circumstances: a record subject to a legal hold, a live safeguarding review, a complaint or an inquiry is not disposed of on schedule, whatever the schedule says, until the hold is lifted and that decision is itself recorded.

Confidential records are disposed of by secure destruction, normally cross cut shredding or a certificated destruction service, with a record of what was destroyed and when. The disposal log is itself a record, and it is the evidence that a deletion was deliberate rather than a loss.

When a pupil moves, and when a school changes

The pupil record should move through the school’s approved transfer process, with a named recipient and receipt confirmation. Safeguarding and child protection records transfer separately and securely under current KCSIE arrangements. Do not treat the transfer as complete merely because an email attachment left the sender’s account; check that the authorised recipient can use it.

The commonest transfer is the ordinary one: a pupil moves to another school. When a child leaves a primary school for a secondary school, or changes school part-way through the year, the education record and the common transfer file go to the new school within fifteen school days of the pupil ceasing to be registered, under the Education (Pupil Information) (England) Regulations 2005. The sending school does not keep a second pupil file once the receiving school has confirmed the transfer, although the DfE guidance separately advises primary schools to retain their management information system data for two terms. Where the destination is unknown, the file is not transferred and school leaders should treat the case as a child possibly missing education, which is a safeguarding matter before it is a records one: the local authority is told and the transfer file goes to the secure lost-pupil database rather than into the archive.

Conversion and reorganisation cause more record loss than any other event. When a school joins a trust, closes, or merges, the records do not evaporate with the legal entity: responsibility passes with it, and someone must be named as the recipient. The commonest failure is a school whose historic files were left in a building that changed hands.

Practically, the point to fix in advance is the list. A school that can show what records it holds, where they are and who is responsible can transfer them. A school that cannot is discovering its retention problem at the worst moment.

The school records that were never records

Every category above is a record the school knows it holds. The gap is the one it does not.

A parent raises a concern by text to a teacher, because that is the number they have. A safeguarding worry is first mentioned in a staff group chat at half past nine in the evening. A trip is reorganised over messages between three members of staff and a coach company. A head of year approves something in a message, and the decision reaches the file, if it reaches the file, as a line typed by someone else the following week.

Each of those is recorded information within the meaning of the Freedom of Information Act, and personal data within the meaning of UK GDPR, and it can be asked for. Almost none of it is held anywhere the school controls. It sits on personal phones, on both sides, belonging to people who may since have left.

That matters most at the moment schools are least able to absorb it. A safeguarding review asks when a concern was first raised. A subject access request from a parent can reach messages about their child on staff personal phones as well as school systems, and the school should ask staff to search their own devices where it has good reason to think the messages are there. An employment tribunal asks what was said to a member of staff and when. In each case a parent or an employee will produce their own copy, and a school that cannot produce its side is not neutral in that exchange, it is silent.

This is a records management question rather than a behaviour one, and staff are not doing anything unreasonable. It is worth asking, at your next leadership or trust board meeting, where the first report of a concern in your school actually lands, and whether you could produce it tomorrow.

Questions people ask

Can you give me some examples of school records?

Examples of school records include the admission and attendance registers, each pupil's educational record, child protection files, accident records, records of educational visits, staff personnel files, pay records, contracts, board meeting records and fire risk assessments. The Department for Education suggests grouping the personal data a school holds about pupils into areas such as admissions, attainment, attendance, behaviour, exclusions, medical information, trips and activities, and safeguarding and special educational needs, whether it is held in paper records, databases or online systems.

What is the legal retention period for children's records in the UK?

In England, a secondary school keeps a pupil's record until the pupil's 25th birthday, and a primary school keeps it until the pupil leaves and then transfers it to the next school. A child protection file is kept until the child's 25th birthday, or the 75th birthday if it relates to child sexual abuse, and moves to any new school separately from the main pupil file. Those periods come from the DfE's record-keeping guidance for schools.

What records should be kept for 3 years?

In a school in England, accident records are kept for 3 years from the date of the accident, pay records for 3 years from the end of the tax year they relate to, and maternity pay records for 3 years after the end of the tax year in which the maternity pay period ends. The DfE adds that an accident involving a pupil should be kept in the pupil record.

What records need to be kept for 7 years?

The DfE's table of school records in England with statutory retention periods has no seven-year period; its most common period is six years. Every entry in the admission and attendance registers must be kept for 6 years beginning with the day the entry was made, and every back-up copy of a register (one must be made at least once a month) for 6 years after the end of the school year it relates to, under regulation 7 of the School Attendance (Pupil Registration) (England) Regulations 2024. Staff personnel files are kept for 6 years from the end of employment, contracts for 6 years from the last payment, and VAT and maintenance records for 6 years from the end of the financial year.

What are the 7 principles of record keeping?

For records containing personal data, the seven principles that apply by law are the data protection principles in Article 5 of the UK GDPR: lawfulness, fairness and transparency; purpose limitation; data minimisation; accuracy; storage limitation; integrity and confidentiality (security); and accountability. The ICO's guide to the data protection principles explains each one, and storage limitation is the one that drives a retention schedule.

What are the legal requirements for record retention in the UK?

UK GDPR requires personal data to be kept for no longer than is necessary for the purposes it is processed for, and some records also have a fixed statutory retention period set by other legislation. The DfE's guidance for schools in England lists records with statutory retention periods, tells schools to decide how long to keep other records "in line with the business need of your school", suggests setting the periods out in a retention schedule, and says records must be disposed of securely at the end of their retention periods.

Where to read the official guidance

Start with DfE record-keeping guidance for schools in England and the current Keeping children safe in education. Use the academy and ICO sources above where they apply. Check the current edition of any IRMS or local authority schedule before relying on it; historic recommendations can differ from current departmental guidance.

This page is a summary rather than advice on your school's own schedule. Where a record is subject to a live inquiry or an ongoing case, take proper advice before disposing of anything.