How long do schools need to retain data?

How long do schools need to retain data?


How long do schools need to retain data?

Read through our global guide to student data storage for your school.

With so many students filtering through our collective school systems every year, records management has become an issue for institutions around the world. And with schools progressively upgrading from paper to digital data, standards on what is kept, and how it’s kept, vary dramatically – and problematically.

Storage isn’t only an issue for schools that are yet to go paperless; it also raises problems for those who store data digitally. And there are many questions schools should be asking third party tech providers concerning data security.

Another question that many schools are asking is: how long should a school retain personal data on its community?

Well, it depends on where you live.

Aotearoa New Zealand

Student data retention laws in Aotearoa New Zealand fall under The Public Records ACT of 2005. The legislation covers all public records, and that includes school records.

The School Records Retention/Disposal Schedule explains the nitty-gritty of how long schools need to keep particular records. In a nutshell, though, when it comes to important student data such as enrolment information and attendance records, schools are required to keep this information for seven years.

Admission and withdrawal registers and punishment registers need to be kept indefinitely. They can be sent to Archives NZ 10 years after the last entry but MUST be sent to Archives NZ 25 years after the last entry. Furthermore, student work and progress records can be “[kept] for as long as the school needs them for school business or reference purposes, then they may be destroyed with the permission of the board of trustees.”


Student data retention in Australia is largely managed on a state-by-state basis, so there’s no uniform timeframe for the length of time records need to be kept.

As an example, Victorian government schools can hold data for up to a year after the student leaves. In contrast, in other states and territories – such as NSW, ACT and WA – schools can hold student data and information until the student either turns 25 or seven years after they leave the school.

There has even been a freeze on the destruction of student records as part of several Royal Commissions and inquiries into institutional child sexual abuse and youth detention in some states. School administrators should always check with their local Education Department or authority for the most up-to-date advice on how long student data has to be kept.


Student data and information record-keeping falls under The Family Educational Rights and Privacy Act, or FERPA as it’s known.

Even though this Act doesn’t formally specify a defined period of time for retaining student data, it’s recommended that schools keep enrolment, financial information, transcripts, disciplinary files, and immunisation and health records for a minimum of five years.

Beyond this legislation, education in the US, like Australia, is largely managed on a state-by-state basis. Administrators should therefore check with their local school district board or state education office for any other compliance issues they have to observe beyond FERPA.


In the UK, schools are required to retain student data for three years from the date of last entry. However, schools at all levels are encouraged to keep their data indefinitely to make it easier for past students to obtain education transcripts and other information related to academic performance.

Why should schools retain data?

Data retention risks have been extolled many times, mainly focusing on the privacy and personal information being used for nefarious purposes without our knowledge.

In Australia, the Royal Commission into Institutional Responses to Child Sex Abuse relied heavily on school records to investigate possible crimes by organisations. The findings showed how important data retention is for schools, and these cases have highlighted schools’ legal obligations and duty of care to students.

Schools should keep records for greater transparency and to mitigate risks, however, finding a way to do so safely and deciding how long they should be held is a tricky issue.

Many schools have to take into account their storage space, as physical files can quite literally populate room after room. Just as long as we can keep this information secure, the length of time it is held may no longer become such a prickly issue. If working with a paper-based system, a move to digital storage is the cheaper and more efficient alternative.

Is your school struggling with data security? Join us for our webinar to find out how to safeguard your school’s valuable data.

Copyright © 2023 EdSmart – Cloud Paper Group Pty Ltd ABN 55 169 666 317. All rights reserved. The EdSmart logo is a registered Trade Mark of Cloud Paper Group Pty Ltd.

  • Product