Retention of Records Policy

Retention of Documents Policy

1.1  Executive Summary

This Policy sets out retention periods for a range of records.  It aims to ensure that these records are managed consistently and are retained for as long as necessary to meet operational and business needs, and to demonstrate compliance with legal and regulatory requirements.  It applies to all the listed categories in whatever format they are held (i.e. paper or electronic).

The retention periods take into account relevant requirements of the University’s regulations and policies, as well as recommendations of the JISC HE Retention Schedule and common practice within higher education.

Unless otherwise stated, it is the responsibility of Schools and Services to retain the items listed in this document.  All Schools and Services will have designated staff who have responsibility for the oversight of records retention and the application of this policy at a local level.

1.2  Introduction

This Policy sets out in the table below the retention periods for a range of records whether they are paper records or electronic.  It aims to ensure that these records are managed consistently and are retained as long as necessary to meet operational and business needs, and to demonstrate compliance with legal and regulatory requirements.

1.3  Retention requirements

In exceptional cases, the retention periods, i.e. the length of time for which each category is to be retained, may be lengthened but will not be shortened.  When determining whether to lengthen a retention period, there will be a need to balance a number of factors, including:

   1.3.1  Limitation Act 1980

Students and staff have a contractual relationship with the University.  Various documents define the terms of the contract (e.g. student handbooks, contracts of employment, programme specifications), while others provide evidence that the University has fulfilled its obligations and compiled with agreed procedures.  The Limitation Act limits the time for bringing a case for breach of contract or negligence to six years from the date of the alleged incident.  Certain records may therefore need to be retained for six years (following a student’s graduation or withdrawal on the termination of staff employment) in case they are required for evidential purposes.

   1.3.2 General Data Protection Regulation

The Data Protection principles stipulate that personal data must only be used for the purposes for which it was lawfully obtained and kept for no longer than necessary.  If personal data is retained, a clear justification for doing so must be made (see section 1.2) and a record kept of the justification in each case.

   1.3.3 Professional, statutory and regulatory bodies

Where Schools provide courses accredited by professional, statutory or regulatory bodies they must ensure compliance with any specific requirements affecting the maintenance and disposal of their records.

   1.3.4 Risk

The risk implications of discarding information should be considered, such as the financial or legal consequences.  If there is an ongoing dispute or high risk of litigation, Schools/Services will need to identify documents of value as evidence and retain them for an appropriate length of time.  They must also ensure that course information is not discarded prematurely but continues to be available for students who take longer than average to complete a course (e.g. part-time students, students who intermit their studies).

Students should be informed about how long records (such as student files and assessed work) will be retained by advertising their retention periods, for example, within student handbooks.

   1.3.5 Cost

 The resource implications of holding records should be considered: e.g. the cost of storage (physical and server), the cost of maintenance, and the cost of responding to Data Protection and Freedom of Information requests (see section 1.2).

2 Data Protection and Freedom of Information

1.1 Records need to be managed in a consistent and controlled way, not only to ensure organisational efficiency but also to comply with statutory requirements, such as Data Protection and Freedom of Information legislation.

The General Data Protection Regulation allows individuals to request access to their personal data (whether in paper or electronic format), and the University must respond to these subject access requests within one month.  The law also requires data to be accurate, kept up-to-date, gathered for a specified purpose, retained for no longer than necessary and protected against unauthorised loss, destruction or damage.  To comply with all these requirements, it is essential that information is managed efficiently and there are clear procedures for its retention and destruction.

The Freedom of Information Act provides a general right of access to the University’s records: the public have the right to be told whether information exists and to receive that information (subject to certain exemptions) within 20 working days of making a request.  Compliance with this legislation relies heavily on effective records management.

Under section 77 of the Freedom of Information Act it is a criminal offence to alter, conceal or destroy any record held by a public body to prevent disclosure of information.  It is therefore essential that staff follow coherent and clearly defined procedures for the management of records: documenting retention periods allows the University to demonstrate that information has been destroyed legitimately and not to prevent disclosure.

2.2  Storage

Documents need to be arranged systematically and labelled helpfully, so that it will be possible to locate them with ease and respond promptly to enquiries.  In the case of electronic information, a logical hierarchical structure of folders and sub-folders should be used to ensure that documentation relating to a particular category and year can be readily identified.

Any records of a confidential nature must be kept securely, and access only granted to authorised staff.  In addition, it is advisable to reserve the immediate office space for paper records that are consulted frequently and therefore need to be close at hand; while documents that will be required for several years, but rarely consulted, can be housed separately.

2.3  Action to be Taken

When the stipulated retention period expires, the Custodian will determine whether there is any legitimate basis for further retention of the relevant record(s). If there is no such basis, the record(s) will be destroyed. If there is a legitimate basis for ongoing retention, then the Custodian must record the justification for ongoing retention and must specify a new review date for that retention.

2 Table of Retention