Reviewing Student Data Retention Boundaries

Protocol status

A retention review is useful when it maps the data store, the rule, the owner, the access, and the deletion evidence for each record class.

This page describes a review design and its proposed controls. It does not report an executed sample, measured outcomes, or evidence that the controls improved performance.

Review protocol

admissions, enrollment, grades, accommodation, conduct, financial, and support communications. Record the system, the owner, and the stated retention rule.

Planned review sequence

1. Define the record classes in scope
2. Map where each class is stored, including shared drives, inboxes, local exports, and vendor systems. A record can leave the official system through an export or a screenshot.
3. Compare the stated rule with the actual retention. Record the retention period, the trigger event, the deletion method, and the evidence. Do not assume that a policy document proves deletion.
4. Review access by role and purpose. A retention problem can become a privacy problem when records remain accessible to people who no longer need them.
5. Sample records that should have been deleted and records that are still active. Record exceptions, legal holds, and approved extensions. Do not delete records during the review.
6. Report the gaps by record class and system. Assign an owner and a remediation date. The review does not provide a legal conclusion or replace the records officer's judgment.

Operational implications

A policy document is not evidence of deletion.

Exports and inboxes can create shadow retention.

Access should follow purpose, not only role.

Legal holds and approved extensions must remain visible.

Deletion evidence needs a date and a method.

The review maps gaps; it does not make a legal determination.