Documentation Retention and Secure Storage
- Version
- 1.0
- Policy owner
- Head of Centre
- Approved
- October 2026
- Next review
- October 2027
DAIS-POL-030
Documentation Retention and Secure Storage Policy
Data and AI School of London, NCFE and OTHM Approved Centre
Policy Owner: Head of Centre
Version: 1.0 | Date: October 2026 | Review: October 2027
Mode of Delivery: Fully Online
30.1 Purpose and Scope
This policy states how long the Data and AI School of London keeps each kind of record, where those records are held, and how they are protected while we hold them. It applies to every record the school creates about a learner, an applicant, a member of staff or its own operation, in every system the school uses.
It exists because the school's retention periods were real but scattered. The principle sat in DAIS-POL-006 Data Protection, the periods applying to learners sat in DAIS-PRIV-001 Privacy Notice, and the rest existed only as settings inside the portal. An awarding organisation, a learner making a subject access request, or the Information Commissioner's Office asks a single question: how long do you keep this, and what makes that happen. This policy answers it in one place.
It does not replace DAIS-POL-006 or DAIS-PRIV-001. Those set the lawful basis and what the school tells people about their data. This sets the schedule and the storage.
30.2 The principle
The school keeps a record for as long as it is needed for the purpose it was created for, for as long as an awarding organisation requires it, or for as long as the law requires, and then no longer. Where those three differ, the longest applies. A record kept beyond its period is a liability rather than an asset: it can be lost, requested or breached, and it serves nobody.
A retention period that nothing enforces is not a retention period. Every period in the schedule below is applied by a scheduled job, and the job is named against it so that the claim can be checked rather than believed.
30.3 Retention schedule
All times are London time. Where a period is stated in years it runs from the record's own date unless the schedule says otherwise.
Learners and applicants
| Record | Kept for | Applied by |
|---|---|---|
| Learner and application records, including assessment decisions | 6 years | Monthly, 1st of the month at 03:40 |
| An application that did not lead to an offer being accepted | 12 months | Nightly at 03:45 |
| Identity document images | 6 months from the identity check | Nightly at 03:45 |
| Register-interest records where no application followed | 730 days | Nightly at 03:15 |
Identity documents are deliberately the shortest period of any learner record. The image is needed to make the check and is not needed afterwards; the record that the check was made is kept with the application.
Contact and communication
| Record | Kept for | Applied by |
|---|---|---|
| Email the school sent about a learner | 6 years, with the application | Weekly, Sunday at 03:40 |
| Email the school sent that is not about a learner | 2 years | Weekly, Sunday at 03:40 |
| Web chat conversations | 90 days | Nightly at 03:20 |
| Telephone call recordings | 180 days | Nightly at 03:10 |
System and access records
| Record | Kept for | Applied by |
|---|---|---|
| Sign-in and sign-out records | 12 months | Weekly, Sunday at 03:40 |
| Activity records about an application | 6 years, with the application | Weekly, Sunday at 03:40 |
| Requests for a learner document, served or refused | 6 years, with the application | Weekly, Sunday at 03:40 |
| Requests for a document matching no learner | 12 months | Weekly, Sunday at 03:40 |
| Fault records, once resolved | 12 months from resolution | Weekly, Sunday at 03:40 |
| Fault records, unresolved | Kept until resolved | Not removed |
| Website page view records | 400 days | Nightly at 03:40 |
A request for a learner's document is kept for six years rather than twelve months on purpose. It is the record a subject access request or an enquiry from the Information Commissioner's Office asks for, and a short window would assume every improper access is noticed inside it. Requests that match no learner are probing rather than access and keep the shorter period.
Backups
| Copy | Kept for |
|---|---|
| Database backups | 30 days |
| Media archives | 14 days |
| Configuration copies | 30 days |
A backup is a copy of records that are themselves within their period. Backups are not a second retention period and are not used to recover a record the school has deleted on purpose.
Anything not named above
A record no rule covers is kept, counted and reported, never quietly removed. The weekly retention run reports the number of such records so that a gap in this schedule is visible rather than silent, and the Head of Centre decides the period before it is applied.
30.4 Where records are held
- The portal. Applicant and learner records, assessment decisions, communications and system records, in a database on the school's own server.
- The virtual learning environment. Learner work, assessor feedback and grades.
- Google Drive, on the school's own Workspace account. Governance documents, policies, registers, and the admissions file for each learner.
- Backups. On the school's own server, under the periods in the schedule above.
30.5 Secure storage
- Learner documents are never served directly from storage. Every request passes through an access-controlled view, and every request, whether served or refused, is recorded with the time, the account, the address it came from and the document requested. That record has been kept since 19 October 2026 and is not retrospective.
- Access to records is by role. A member of staff is given the smallest role that allows them to do their work, and roles are reviewed when a person's duties change.
- Records in transit are protected by encryption in the ordinary course of the systems the school uses.
- Credentials are never stored in the school's code repositories, and the repository holding the portal is private.
- Where a copy of a record is made for a technical purpose, it is removed when that purpose ends rather than left in place.
30.6 Destruction
Removal under this policy is deletion of the record from the system that holds it, carried out by the scheduled job named in the schedule. Where a record is held in more than one place, each place is covered by its own line in the schedule. Where a record must be removed outside the schedule, for example on a valid erasure request, it is removed under DAIS-POL-006 and the fact of the removal is recorded.
30.7 Responsibilities
- The Head of Centre approves every period in this schedule and any change to it, and is asked to decide a period for any record the schedule does not cover.
- Staff do not keep private copies of learner records outside the systems named in 30.4.
- Anyone who finds a record outside its period, or a record the schedule does not cover, reports it so that the schedule can be corrected rather than the record quietly deleted.
30.8 Review
This policy is reviewed annually, and sooner if an awarding organisation changes what it requires, if the law changes, or if the school begins to hold a kind of record the schedule does not name.
30.9 Related documents
DAIS-POL-006 Data Protection (UK GDPR). DAIS-PRIV-001 Privacy Notice. DAIS-POL-008 Learner Recruitment, Registration and Certification. DAIS-POL-011 Safeguarding. DAIS-POL-016 Assessment and Internal Quality Assurance.