In-Touch Schools Data Retention & Deletion Policy

Provides a governance framework for retention, archival, deletion and de-identification of information.

1. Principle

Information should not be kept indefinitely without a documented reason. Retention must balance operational need, school obligations, legal requirements, audit needs and the rights of data subjects.

2. Categories

Retention schedules should distinguish account information, learner-school records, academic records, attendance, communications, consent records, support records, audit/security logs, backups and contractual records.

3. School records

The school should define the authoritative retention period for school-controlled learner records, taking account of applicable education and legal requirements. In-Touch Schools should not independently shorten a school’s legally required retention period.

4. Platform records

Operational logs and security records may be retained for a defined period necessary for security, troubleshooting, fraud prevention and audit. The precise period should be documented in the production data-retention schedule.

5. Backups

Deleted information may remain temporarily in encrypted backups until the relevant backup cycle expires. Backup retention and restoration procedures should be documented.

6. Secure deletion

When retention ends, information should be securely deleted, destroyed or irreversibly de-identified using processes appropriate to the medium and risk.

7. Legal holds

Information may be retained beyond normal periods where necessary for legal proceedings, investigations, regulatory requirements or other lawful obligations.

8. Governance

The Information Officer and relevant school governance personnel should review retention schedules periodically and when laws, contracts or processing purposes change.