Kept for no longer than is necessary
Kept for no longer than is necessary
Retain personal data for no longer than is necessary for the purpose or purposes for which it was obtained. Schools/ETBs must:
- Review the length of time you keep personal data
- The responsibility for ensuring that data are kept for appropriate periods rest with the Board of Management (or in the case of an ETB school, with the ETB). The Board of Management (or employer for ETB schools) must have a clear, transparent and compelling justification for retaining each class of data for a specified period.
- Be mindful of the minimum statutory obligations concerning retention of records. Further details are available on this website under the link Guidance on school records and retention periods and also on the Records Retention Schedule
- Securely delete/destroy information that is no longer needed and regularly purge databases of data which are no longer required
- Establish, implement and regularly review your records retention policy and procedure – different categories of information may require different and appropriate retention periods
- Remember retaining on a ‘just in case’ basis is not acceptable. If a school considers that it is reasonably foreseeable that litigation/legal proceedings will be brought against the school/ETB in respect of a particular issue, they should not delete the data relating to that issue and should obtain legal advice.
It is a key requirement of data protection legislation that personal data collected for one purpose cannot be retained once that initial purpose has ceased. Equally, as long as personal data is retained the full obligations of the Acts attach to it. Importantly, certain legislation prescribes a statutory minimum retention period (particularly employment law) It is important that schools/ETBs are mindful of these as minimum requirements. Further details are available on this website under the link Guidance on school records and retention periods and also on A-Z Retention Schedule
Schools/ETBs should assign specific responsibility to someone for ensuring that files are regularly purged safely and securely, and that personal information is not retained any longer than necessary. This can include appropriate anonymisation of personal data after a defined period if there is a need to retain non-personal data. Anonymisation must be irrevocable, and removing the names/addresses of individuals would not necessarily be sufficient.
To comply with this rule, schools/ETBs should have: