Keeping records and files secure in a school office

What the law asks for

Article 32 of the GDPR requires appropriate technical and organisational measures to keep personal data secure. "Appropriate" is deliberately relative — it is measured against the risk, the state of the art and the cost of implementation, so a primary school with one office is not held to a multinational’s standard.

What it does mean is that the measures have to exist, and that you can say what they are. A school that has locks, a retention schedule and a shredder but nothing written down is in a weaker position than one with a modest policy it follows, because the second one can answer the question.

The controls, and what to write about each

• Access — who holds keys and codes to the rooms and presses where personal data is stored, and what happens to that access when somebody leaves. The leaving half is the one that goes stale.
• Storage — lockable presses for files containing personal data, and a stated rule that they are locked rather than lockable. A press that is never locked is a shelf.
• Separation — child-protection and medical records held separately from general administrative files, with a narrower list of people who can reach them.
• Retention — how long each category is kept, and on what basis. This is the clause most schools have never written, and it is the one that answers "why do you still hold this?"
• Disposal — cross-cut shredding or a confidential waste contractor, with a certificate of destruction where the contractor provides one. Recycling is not disposal.
• Visitors and contractors — who is unaccompanied in rooms where records are held, including cleaning and maintenance staff working outside school hours.
• Off-site — whether files leave the building at all, who authorises it, and how they travel.

None of these is expensive. The failure is almost never the lock; it is that nobody can say what the retention period for a given category is, so nothing is ever destroyed and the volume of data the school is responsible for grows every year.

The retention schedule is the hard part

A retention schedule lists each category of record the school holds, how long it is kept, what triggers the clock, and what happens at the end. It is tedious to build once and close to self-maintaining afterwards.

The categories that cause the most argument are the ones where a retention period is set by something other than data-protection law — employment records, incident reports that might become litigation, child-protection records with their own statutory requirements. Those need the school’s own legal or DPO input rather than a generic template, and a template that pretends otherwise is doing you harm.

What a school can do without waiting for anybody: write down every category of personal data the office holds, and where. Most schools have never had that list, and the exercise usually finds two or three filing systems nobody had counted.

Keeping the written version true

A records policy goes out of date the way a building does — slowly, and then all at once when something changes. A new MIS, a move to a different office, a new confidential waste contractor, a change of secretary. Each one can make a clause untrue without anyone noticing.

The protection is a review date and an owner. The Board of Management adopts the policy, somebody is named as responsible for it, and the review happens on a cycle rather than when a problem surfaces. The record that matters afterwards is which version was in force on a given date, and who had acknowledged it.