- Retention
- Review
- Access
- Correction
- Restriction
- Secure Disposal
- Record owners
- Purposes
- Legal requirements
- Source organisations
- Sensitivity
- Retention periods
- Review dates
- Disposal requirements
A school record can therefore reach the end of its justified retention period even where the learner continues to have an EdiWay identity.
“Why do we still need it?”
A responsible retention decision can consider:
Record Type
What information is being held?
Purpose
Why was it created or collected?
Responsible Organisation
Who is accountable for retaining it?
Requirement
Does legislation, guidance, contract or another obligation affect retention?
Operational Need
Is the information still needed for an active process?
Sensitivity
Does the record require additional lifecycle controls?
Historical Value
Is there a justified reason for preserving history?
Disposal Point
What should happen when the reason for retaining it ends?
- Pupil records
- Attendance
- Admissions
- Safeguarding
- SEND and support
- Medical and care information
- Communications
- Finance
- Governance
- Workforce records
- Recruitment
- Contracts
- Operational records
- Evidence and documents
Some periods may come from specific legal requirements. Others depend on the organisation’s legitimate operational need and data-protection responsibilities. EdiWay can support structured lifecycle controls, but the responsible organisation remains accountable for the retention policy it applies.
Primary Pupil Records
Are generally retained by the school until the learner leaves and then transferred as appropriate, with specified MIS reporting considerations after departure.
Secondary Pupil Records
Are retained until the learner’s 25th birthday, subject to the applicable record and transfer requirements.
Attendance and Other Records
Can have their own separately defined periods.
Child Protection Files
Are generally retained until the learner’s 25th birthday.
Where a child-protection file relates to child sexual abuse, the current guidance specifies a substantially longer retention period.
These are examples from current guidance for England. Requirements can vary by record type, organisation and UK jurisdiction, so EdiWay should not convert these examples into one universal UK retention rule.
School-Origin Records
Remain attributable to the school or relevant school user.
Family Contributions
Remain attributable to parents and carers.
Learner Contributions
Remain learner-origin information.
Professional Evidence
Retains its professional source.
Imported Records
Should retain relevant migration and provenance information.
EdiWay Account Information
May have a separate platform lifecycle from records created by a school or other organisation. This distinction becomes particularly important when a retention or deletion decision is made.
Closing one organisational relationship should not silently rewrite the origin of information held elsewhere.
- Transferred
- Retained
- Archived
- Restricted
- Reviewed
- Securely disposed of later
The learner may meanwhile continue within EdiWay through another school, Home Education, another education pathway or eventually an Adult Learner Account. The school should therefore update its relationship and responsibilities rather than assuming that either:
everything must disappear immediately or everything can remain indefinitely.
- “delete everything about the learner at 25.”
Other records may have shorter periods.
Some safeguarding information can have substantially longer retention requirements.
Some financial, governance, employment or operational records follow different rules.
And an adult learner may separately choose to maintain an ongoing EdiWay learning relationship where there is an appropriate basis for doing so.
The record category and responsible organisation still matter.
- Ongoing safeguarding work
- Legal proceedings
- Investigation
- Complaint
- Regulatory matter
- Active information-rights request
- Other documented preservation requirement
EdiWay’s governance architecture includes the concept of legal hold for appropriate controlled workflows.
Where a valid hold applies, ordinary disposal can be suspended until the responsible person determines that the hold can end.
A legal hold should itself be governed rather than becoming an excuse for indefinite retention.
Deletion
Remove data that no longer needs to be retained.
Anonymisation
Where appropriate, remove the ability to identify the individual while retaining legitimate non-personal information.
Disposal Evidence
Record relevant information about an authorised disposal process where the workflow requires it.
Source-System Closure
Ensure information is not left indefinitely in forgotten exports, temporary files or migration copies.
Deleting a visible screen while leaving uncontrolled duplicates elsewhere is not good retention management.
Information
Understand how personal data is being used.
Access
Receive personal data and relevant information about its use.
Rectification
Ask for inaccurate information to be corrected or incomplete information completed.
Erasure
Request deletion where the right applies.
Restriction
Ask for processing to be limited in certain circumstances.
Objection
Object to certain forms of processing.
Portability
Receive and reuse certain information where the legal conditions for portability apply.
Automated Processing
Receive relevant protections around certain automated decision-making.
These rights are important. They are not all absolute and do not all apply to every processing activity.
- The learner's age
- Understanding and competence
- The requester's authority
- Parental responsibility
- The learner's wishes where appropriate
- Sensitive information
- Safeguarding considerations
EdiWay’s relationship model can help retain relevant family and authority context. The responsible organisation still makes the decision about the request.
- What was originally recorded
- Who recorded it
- When it was recorded
- What was later corrected
- Why the correction was made
The appropriate approach depends on the record and purpose. EdiWay is designed to support source and history rather than making every correction an invisible overwrite.
- What information they use
- Why they use it
- Which provider may process it
- How relevant outputs are retained
- Whether automated processing is involved
- What rights apply
EdiWay’s own AI governance direction keeps consequential outputs human-reviewed and preserves the distinction between underlying evidence and generated drafts. An AI-generated summary should not become a way of avoiding a correction, retention, or access obligation that applies to its underlying source information.
1. Recognise the Request
A person does not necessarily need to use legal terminology for an information-rights request to be valid.
2. Identify the Individual
Confirm who the request concerns.
3. Check Authority
Where somebody is acting for another person, establish the appropriate authority.
4. Understand the Request
Identify the information and right being exercised.
5. Find Relevant Records
Search the appropriate governed sources.
6. Review Sensitivity and Third-Party Information
Consider what can appropriately be disclosed or changed.
7. Apply Relevant Restrictions or Exemptions
Where these lawfully apply.
8. Take the Appropriate Action
Provide, correct, erase, restrict or otherwise respond according to the request and applicable rules.
9. Record the Outcome
Keep appropriate evidence of how the request was handled.
10. Maintain the Record Lifecycle
Do not allow a rights request to create uncontrolled duplicate exports or indefinite retention.
1. Identify the Record
What information is this?
2. Establish the Source
Who created or owns the record?
3. Define the Purpose
Why is it being retained?
4. Apply the Relevant Schedule
Which organisational or legal retention rule applies?
5. Restrict Sensitive Information
Use stronger controls where needed.
6. Review at the Appropriate Point
Does the reason for retention still exist?
7. Check for Holds
Is deletion currently prevented by a legitimate preservation requirement?
8. Transfer Where Required
Move appropriate records through a governed transfer process.
9. Dispose Securely
Delete or anonymise where the retention period has ended and no reason to preserve the record remains.
10. Keep Appropriate Evidence
Record material retention and disposal actions where required.
- Record provenance
- Relationships
- Permissions
- Audit events
- Retention events
- Legal holds
- Controlled export
- Adult learner lifecycle
- Erasure-request workflows
- Source history
- Deletion or anonymisation evidence where supported
But EdiWay does not decide, by itself, which lawful basis applies, which exemption should be used, whether a particular Subject Access Request should be refused, or exactly how long every organisation must retain every record. Those decisions remain with the relevant controller and authorised people.
No.
A connected learner identity does not justify indefinite retention of every underlying record.
Different information has different purposes and retention requirements.
No.
Some information may be transferred, some may need to remain for a defined period, and other information may no longer be required.
The answer depends on the record and applicable retention rules.
No.
The 25th birthday is relevant to certain records in current England guidance, including secondary pupil records and many child-protection files.
It is not a universal deletion date for every type of information.
Current England guidance generally provides for the pupil record to transfer to the next appropriate school, with separate MIS reporting considerations after departure.
Other UK jurisdictions and settings may have different requirements.
Yes.
Safeguarding records can have different retention rules, including significantly longer periods for certain records.
A legal hold is a controlled reason to suspend ordinary disposal where information needs to be preserved for an applicable legal, investigative or other governed purpose.
Individuals may have access rights regarding personal information held about them.
The appropriate request route and responsible controller depend on which organisation holds the information and why.
Yes.
Children have information rights too.
The organisation should consider the learner’s understanding, circumstances and any representative relationship when responding.
Parents and carers may be able to act for a learner in appropriate circumstances.
Parental or family access should not be treated as an automatic right to every record regardless of the learner’s age, competence, wishes or sensitivity of the information.
The right to rectification can apply to inaccurate or incomplete personal information.
Some governed records may preserve the original history alongside a correction rather than silently rewriting it.
No.
The right to erasure is not absolute, and some information may need to remain because of legal, safeguarding, public-task, evidential or other applicable requirements.
Yes, where the right to restriction applies.
The information may continue to be stored while its use is limited.
No.
The statutory right to data portability applies only in particular circumstances.
EdiWay may offer separate export or transition functionality beyond that legal right.
For schools in England, current DfE guidance generally requires a response within one calendar month, subject to rules around identity, clarification and complex requests.
No.
EdiWay can support the information and workflow needed to handle the request.
The relevant data controller remains responsible for the decision and response.
An eligible adult learner may continue an EdiWay learner relationship under the applicable EdiWay account and retention model.
That does not give a former school permission to retain school-origin records beyond its own justified retention period.
Privacy and Data Protection
Understand the principles governing the use of personal information.
Permissions, Consent and Information Sharing
See how viewing, sharing and exporting information remain separate governed actions.
Safeguarding Boundaries
Understand the stronger lifecycle and access controls around safeguarding information.
Adult Learner Record
See how responsibility can move towards the learner as they enter adulthood.
Transition Packs and Learner Continuity
Understand controlled information sharing between education settings.
Data Retention and Subject Rights
Explore the controls protecting information throughout its lifecycle.
Implementation, Migration and Product Assurance
See how EdiWay distinguishes product capability from deployment and assurance.
- Know why information exists.
- Know who is responsible for it.
- Preserve its source.
- Keep it for the appropriate period.
- Protect it while it remains necessary.
- Respond when people exercise their rights.
- Correct inaccuracies without destroying important history.
- Restrict processing where appropriate.
- Dispose of information securely when its purpose ends.
- And let the learner continue without assuming every organisation must keep every historical record forever.