What a Clean Desk Policy is, and what yours should say

What the policy covers

A Clean Desk Policy sets out how staff handle and store personal data when they step away from it. It is a paper-and-screens policy, not a tidiness policy, and the distinction matters when you write it: the point is not a neat office, it is that a contractor, a visiting parent or a pupil walking past an unattended desk cannot read a child’s file.

Article 5(1)(f) of the GDPR requires personal data to be processed with appropriate security, including protection against unauthorised access. That duty applies to the printout on the desk exactly as it applies to the database. A school that encrypts its MIS and leaves the attendance folder open on the front-office counter has secured one and not the other.

In a school the exposure is particular. Reception sits in a corridor pupils use. The staff room has visiting coaches in it. The photocopier is in a shared space and holds the last thing somebody printed. None of that is a failing — it is what a school building is — which is why the policy names the practice rather than trusting the layout.

The clauses worth writing down

A policy that says "staff should keep desks tidy" cannot be followed or enforced. These are the clauses that give it teeth:

• Paper containing personal data goes into a locked press before the room is left unattended — not at the end of the day, when the room is left.
• Screens are locked when the desk is left, with an automatic lock as the backstop rather than the primary control.
• Nothing with a pupil’s name on it is left on the photocopier, the printer or the scanner glass.
• Whiteboards are cleared of names, initials and case details after a meeting.
• Post-its with passwords are not a thing that exists. Neither is a shared password in a desk drawer.
• Confidential waste goes in a locked confidential bin, not the recycling. If the school has no confidential waste stream, the policy is describing something the school cannot do.
• Removable media and files are not taken home except where a separate, named policy allows it.

Who approves it, and when it is reviewed

A Clean Desk Policy is adopted by the Board of Management like any other school policy. That matters for two reasons: it is the Board that carries the governance responsibility, and an adopted policy with a recorded approval date is evidence, where a document in a shared drive is not.

The record that counts has four parts: the version of the text, the date the Board approved it, the date staff were told about it, and the date it is next due for review. A policy with no review date drifts out of accuracy quietly — a new building, a new MIS, a new confidential waste contract, and the document on file now describes a school that no longer exists.

Acknowledgement is the part most often missing. "The policy is on the shared drive" is not the same as knowing which members of staff have read it, and in a data-protection conversation the difference is the whole conversation.

What it sits beside

A Clean Desk Policy on its own is thin. It works as one clause-set inside a group of documents that cover the same risk from different angles: a Records Management and Retention Policy for how long paper is kept and how it is destroyed, an Acceptable Use Policy for the devices on the same desks, and a Data Breach Response procedure for the morning one of them fails.

If you are writing the Clean Desk Policy from scratch, it is usually quicker to work out which of those four you already hold, in what state, and with what approval dates, before writing any new text.