Retention of Child Protection Information is for 25 years from the DOB of the Pupil 

The Education (Pupil Information)(England) Regulations 2005 (SI 2005/1437 states that pupil records should be retained for 25 years from the date of birth of the pupil. 

This is reiterated in the Government Guidance contained in the Data Protection Toolkit for Schools 2018 where at page 31 of the guidance it is made clear that in circumstances where detailed information about activities in school may form an important part of safeguarding, that individual information should be retained long term until the child is 25 years of age or older. https://www.gov.uk/government/publications/data-protection-toolkit-for-sch

The Information Management Toolkit for Schools (IRMS Schools Toolkit) from the Information and Records Management Society (IRMS) which is commonly used by schools and local authorities also reiterates  this guidance on page 93  where it states the retention period be the date of birth of the child plus 25 years then review.  https://irms.org.uk/page/SchoolsToolkit

It is also important to ensure that child protection records are stored separately and securely as in accordance with the statutory guidance given in Keeping Children Safe in Education 2021. The only individuals who should be permitted access to these records are those who bear the responsibility for Safeguarding. 

Retain Records About Historical Allegations of Child Sexual Abuse until the conclusion of The Independant Inquiry into Child Sexual Abuse Until the Conclusion of the Inquiry

Since the beginning of the Independent Inquiry into Child Sexual Abuse (IICSA), organisations have been required to retain and not destroy any records that might be relevant to the inquiry. Under the terms of the inquiry Schools and Colleges have an obligation to preserve records which contain information about allegations of sexual abuse for the Independent Inquiry into Child Sexual Abuse (IICSA), For the specific terms of the inquiry, further information can be found on the IICSA website.  The IICSA is currently ongoing. Although the public hearings are now complete, investigation reports in relation to the Inquiries investigations will continue to be published throughout 2022 with a final report to follow thereafter. 

Until the Inquiry is concluded schools must retain and preserve these records. Such information may include, but is not limited to, the following:

1. Any material, including reports; reviews; briefings; minutes; notes and correspondence in relation to allegations (substantiated or not) of individuals, organisations, institutions, public bodies or otherwise who may have been involved in, or have knowledge of, child sexual abuse, or child sexual exploitation;
2. Any material, including reports; reviews; briefings; minutes; notes and correspondence in relation to allegations (substantiated or not) of individuals having engaged in sexual activity with, or having a sexual interest in, children;
3. Any material, including reports; reviews; briefings; minutes; notes and correspondence in relation to institutional failures to protect children from sexual abuse or other exploitation;
4. Any material relevant to statutory responsibilities for the care of children in public or private care;
5. Any material relevant to the development of policy on child protection;
6. Any material relevant to the development of legislation on child protection;
7. Any material relating to the determination of the award of Honours to persons who are now demonstrated to have had a sexual interest in children or are suspected of having had such an interest.

The legal position in relation to records that contain information about allegations of child abuse is reiterated in the Statutory Guidance contained in Keeping Children safe in Education 2021 at paragraph 339 which states that ‘Schools and colleges have an obligation to preserve records which contain information about allegations of sexual abuse for the Independent Inquiry into Child Sexual Abuse (IICSA), for the term of the inquiry (further information can be found on the IICSA website). All other records should be retained at least until the accused has reached normal pension age or for a period of 10 years from the date of the allegation if that is longer.

https://www.gov.uk/government/publications/keeping-children-safe-in-education--2 

The Data protection position in relation to the IICSA has been considered by the IICSA.  The Inquiry consulted with the Information Commissioner’s Office upon GDPR issues and issued Guidance to clarify the position which can be found on the IICSA website https://www.iicsa.org.uk/key-documents/115/view/2018-07-25-guidance-note-retention-instructions-data-protection-requirements-version-2.pdf

Under the Inquiries Act 2005, Section 21 the Inquiry has the power to order the production of documents and failure to comply with such an order without reasonable excuse is an offence punishable by imprisonment (Section 35 of the Inquiries Act 2005). It is also an offence for a person, during the course of an Inquiry, to destroy, alter or tamper with evidence that may be relevant to an Inquiry, or to deliberately do an act with the intention of suppressing evidence or preventing it being disclosed to the Inquiry. Institutions therefore have a legal obligation to preserve records for the Inquiry for as long as necessary to assist the Inquiry. Because institutions may have to account for their previous activities to the Inquiry retention of the data in relation to child sexual abuse will be regarded as necessary for this purpose and prolonged retention of personal data by an organisation at the request of the Inquiry would not therefore contravene data protection legislation, provided such information is restricted to that necessary to fulfil any potential legal duties that organisation may have in relation to the Inquiry.  

Ensure You Have A Clear Retention Policy 

UK GDPR requires organisations to have clear retention policies. 

The Government Guidance contained in the Information Sharing DfE, 2018 guidance makes clear that 'In line with each organisation’s own retention policy, the information should not be kept any longer than is necessary. In some rare circumstances, this may be indefinitely, but if this is the case, there should be a review process scheduled at regular intervals to ensure data is not retained where it is unnecessary to do so’. 

Schools should therefore ensure that they have a data retention policy which deals with the retention of this type of data as set out above and that a Data Protection Annual review is undertaken each year to assist to ensure compliance.

A Note On Transferring Safeguarding Files To A New School or College 

In England and Wales the statutory guidance for schools set out in Keeping Children Safe in Education 2021 requires that DSLs should ensure that records are transferred to the new school or college as soon as possible, ensuring secure transit, with confirmation of receipt being  obtained. This is to ensure that the new school is made aware of any safeguarding concerns as soon as the child starts at the new school. Any delay could negatively impact the health, safety and welfare of a vulnerable pupil. 

Remember that if you are dealing with paper files the most secure way to transit these records is to deliver them up by hand to the DSL of the new school and to obtain a signed receipt.  

The computer systems used by schools including CPOM”s and Myconern have the facility to electronically do this. When an electronic transfer on these systems takes place the previous school relinquish access to the data, and access rights are transferred to the new school with the data remaining intact on the electronic system. For more information about how your particular system works you should check with the provider of the system that you use.

It should be noted that The Pupil information is the Education (Pupil Information)(England) Regulations 2005 (SI 2005/1437 also provides relevant statutory guidance on the transfer of pupil information.