The issue of data retention is often overlooked in conversations about education technology and data privacy. While security breaches and unauthorised data access are widely discussed, the silent risk of holding onto student data indefinitely is just as concerning. Without clear policies in place, personal information can remain on servers for years, long after students have left school.
This raises key concerns about privacy, compliance with regulations, and the ethical responsibility of educational bodies and EdTech providers. If student data is no longer needed for educational purposes, why is it still being stored? And more importantly, how can institutions develop better policies to ensure responsible data management?
The Current Landscape of Data Retention
A lack of clear data retention policies is a widespread issue in education. According to the UK's Department for Education, only a small percentage of schools have established policies outlining how long student data should be stored before being securely deleted. (GOV.UK)
This means that personal details, academic records, attendance logs, and even behavioural data can remain in databases for years, sometimes indefinitely. In some cases, schools and EdTech providers may not even be aware of how much historical data they are still holding onto.
This prolonged storage of sensitive information is particularly concerning given the increase in cyber threats. The 2024 Cyber Security Breaches Survey found that 71% of secondary schools in the UK experienced cyber incidents in the past year, a sharp increase from previous years. (GOV.UK)
If schools and EdTech providers are holding onto student data for longer than necessary, they are also increasing the risk of that data being exposed in a breach. The more data stored, the more attractive a target it becomes for cybercriminals.
The Risks of Prolonged Data Storage
Storing student data longer than necessary introduces several significant risks:
- Increased exposure to breaches: The longer data is kept, the greater the risk of it being accessed in a cyberattack. If a school or EdTech provider suffers a security breach, older records could be compromised alongside current ones.
- Non-compliance with data protection laws: UK GDPR states that personal data must not be kept for longer than is necessary. Education providers that fail to comply could face penalties and legal consequences.
- Erosion of trust: Parents and students expect educational bodies to handle their personal data responsibly. If data is stored indefinitely without clear justification, it can lead to a breakdown in trust.
- Data mismanagement: The longer data is stored, the harder it becomes to track, organise, and secure. Without proper retention schedules, institutions risk losing control over what data they hold and why.
Best Practices for Data Retention in Education
To address these challenges, schools, colleges, and EdTech providers should take proactive steps to implement responsible data retention policies.
- Develop clear retention policies: Education providers should establish clear guidelines on how long different types of student data should be stored before deletion. These policies should align with legal requirements and educational needs. (GOV.UK)
- Regular data audits: Conducting annual reviews of stored data can help identify and securely delete information that is no longer needed. This reduces unnecessary risk and ensures compliance with regulations.
- Engage with stakeholders: Transparency is key. Schools and EdTech providers should communicate their data retention policies with students, parents, and staff, ensuring they understand how their information is being used and for how long.
- Automated deletion protocols: Implementing systems that automatically remove data after the retention period expires helps to ensure data is not kept longer than necessary. This reduces human error and ensures compliance with retention schedules.
- Secure disposal of data: Simply deleting data is not always enough. Institutions should ensure that when data is removed, it is done securely and in a way that prevents recovery or unauthorised access.=
The way education providers handle student data is just as important as how they collect it. While EdTech platforms bring immense benefits to education, they also come with the responsibility of safeguarding personal information and ensuring that data is only stored for as long as it is genuinely needed.
Prolonged data storage is an unnecessary risk that increases exposure to cyber threats, raises legal concerns, and undermines trust between institutions and the people they serve. Schools and EdTech providers must work together to prioritise data retention policies, ensuring student information is managed responsibly.
By taking action now, we can create an education system where privacy is protected, compliance is maintained, and student data is only kept for as long as it serves a legitimate purpose.
