How long do schools keep your data after you graduate — and what you can ask for

Two related but distinct questions get tangled together when a student leaves school:

1. How long does the school keep my data?
2. What can I ask for back?

They sound the same. They're really not. This post takes them apart.

What the school holds

A school holds many different kinds of data about you, each governed by different retention rules. The big categories:

• Official records — admission records, attendance, exam results, safeguarding flags, SEN/EHCP documents, behavioural records. Often retained for decades under statutory rules.
• Pastoral records — tutor notes, reports, parent communications. Typically retained until adulthood or longer.
• Curriculum work — your essays, coursework, projects, OneNote notebooks. Held inside your Microsoft 365 account, retained as long as the account is active.
• Financial records — fee history (independent schools), free school meal eligibility, bursary records. Held under HMRC and audit retention rules.

Each category has its own retention schedule. There isn't a single answer to "how long do schools keep data" — there are dozens of answers depending on the record type.

What's kept the longest, and why

The records kept longest tend to be the ones the school is legally required to retain. In the UK, examples:

• Admission registers: at least 3 years after the last entry, often longer.
• Attendance registers: 3 years.
• Pupil records (the main student file): until age 25 for most pupils, longer for SEN, longer still for safeguarding flags.
• Exam results: indefinitely on summary basis.
• Safeguarding records: until age 25, often longer.

These are governed by the Information and Records Management Society (IRMS) toolkit for schools, the GDPR principle of storage limitation, and various sector-specific rules.

What's kept for the shortest time

The shortest-retained data is, ironically, the work you actually made: your curriculum content. Your school doesn't retain a copy of your OneDrive or your OneNote class notebooks after your account closes. The licence ends, the account is deleted, the content goes.

This is the gap mydocs.school exists to fill. The institutional records of your time at school survive; the work you did doesn't.

What you can ask for back

UK GDPR (and equivalent regimes elsewhere) gives you the right to a Subject Access Request (SAR) — you can ask the school for a copy of the personal data they hold about you. They have to respond within 30 days.

What you can get via SAR:

• Copies of records the school holds about you in their MIS, safeguarding files, pastoral notes, financial records, etc.
• Email correspondence about you (between staff, where you're identifiable).
• Behaviour and attendance records.
• Reports the school wrote about you.

What you can't get via SAR (in most cases):

• Other students' data, even if you appear in it.
• Confidential staff opinion notes (often exempt).
• Internal management deliberations.
• Information that would identify a confidential source.
• Records that fall under safeguarding exemptions in some circumstances.

A SAR is not a recovery mechanism for your curriculum work. A SAR gets you records about you. It doesn't recover the essays you wrote, the OneNote notes you took, or the PowerPoints you made — those are work you produced, not records the school holds about you.

How to make a SAR

In the UK, write to your school's Data Protection Officer (DPO). Most schools publish the DPO contact on their privacy policy page, often on the school website footer. State clearly that you're making a Subject Access Request under UK GDPR, give your full name and dates of attendance, and be as specific as you can about what you want.

The school has one calendar month to respond. They may extend this by up to two further months for complex requests, but they have to tell you they're extending and why.

You don't need a reason. The right exists; you don't have to justify exercising it.

What about FOI?

A Freedom of Information request is a different mechanism — it gives you the right to information held by public bodies, not personal data about you. State schools and academies are subject to FOI; independent schools generally aren't. FOI is the right tool if you want to know, say, the school's retention policy itself, or aggregate data about exam results, not for retrieving your personal records.

The honest position on curriculum work

If you want your essays, your OneNote notebooks, your coursework drafts: download them while your account is still active. The school is not obligated to keep them after deactivation, and reasonable retention schedules don't require them to.

This is true under UK GDPR. It's true under FERPA in the US. It's true under PIPEDA in Canada, the Privacy Act in Australia, the Data Protection Act in Ireland. The right to retrieve work you produced is a feature of the active account; once the account is gone, the legal frameworks don't typically restore it.

The corollary: if you want a copy, download it before the account closes. mydocs.school exists for exactly this; the manual paths work too. Either way, do it before deactivation, not after.

A note for IT teams reading this

A persistent confusion among leavers is conflating "the school holds records about me for years" with "the school has a backup of my OneDrive for years". The first is usually true; the second is almost never. The IRMS retention toolkit is clear on this — student curriculum work is not in the long-term retention scope. If your school doesn't currently surface this to leavers, a one-line note in the leaver email about the difference between the two pays for itself in reduced SAR-misuse and complaint volume.

Per-country notes

• UK: UK GDPR + Data Protection Act 2018. SAR is the relevant mechanism. ICO guidance is on ico.org.uk.
• Ireland: EU GDPR. SAR equivalent. Data Protection Commission at dataprotection.ie.
• US: FERPA for educational records. The right to inspect and review applies while you're a student; alumni rights are narrower.
• Canada: PIPEDA federally, provincial privacy law in addition. Each province has its own commissioner.
• Australia: Australian Privacy Principles under the Privacy Act 1988. The OAIC has guidance.
• NZ: Privacy Act 2020.

The shape of the right is similar in each: records about you are recoverable; work you produced generally is not, once the account is gone.