Education

Student files: 5-year retention after de-registration

4 February 2026 · 6 min read · DeSnipperaar

In primary and secondary education a great deal is recorded about every pupil: reports, action plans, transfer files, parent meetings, medical notes. A sizeable portion of this may not be destroyed immediately after the pupil leaves, but certainly should not sit around forever. This article offers guidance to school administrations that want to clean out the archive each year without breaching the GDPR or the sector laws.

The legal framework

Two tracks are decisive: the GDPR (general) and the WPO (primary education) and WVO (secondary education) respectively. The GDPR says: do not keep longer than necessary. The sector laws make concrete which period is "necessary" for which records.

• Educational report: retain for five years after the pupil's de-registration.
• Attendance and enrolment data: five years after de-registration.
• Grade lists and test results: as a rule two years after de-registration (with the exception of exam results, where separate rules apply).
• Data on guidance and care (dyslexia, behaviour, medication): typically three years after the end of the guidance, unless relevant for longer.
• Financial administration (parental contribution, school trip): seven years (tax).

Note: periods are maxima generally used as the retention period. Once they expire, you must destroy. Keeping longer is a GDPR breach unless you have a specific basis.

Special categories

Medical notes and health information fall under GDPR art. 9 (special categories). A stricter duty of care applies: restricted access, a clear basis, prompt destruction after the purpose ends. Notes about "pupil medication" in a paper folder are sensitive paper. At de-registration, and certainly at transfer to another school, the flow must be clear: transfer with parental consent, or destroy.

Every gym folder noting "not participating due to asthma" is a GDPR file. Treat it as such.

Transfer files and draft versions

At transfer to secondary education a transfer file follows the pupil. The copy that stays at the primary school may be destroyed five years after de-registration. Drafts of educational reports, working notes from the in-house counsellor and concept action plans, so once the final version is set, may be destroyed earlier. Minutes of pupil discussions that list names also fall under the GDPR.

The annual clean-up

Schools have natural moments for a destruction run: end of school year and start of calendar year. A practical approach:

1. Walk through the records by year cohort: pupils de-registered in school year X-5 are eligible for destruction.
2. Separate by period: a file part with a five-year period is ready, a part with a seven-year period (financial) stays a little longer.
3. Have a second pair of eyes (for example the DPO) review before the boxes are closed.
4. Schedule an on-site destruction run at the school.
5. Archive the certificate in your records of processing.

See also our GDPR retention periods cheatsheet for an overview of generic periods.

Why on-site destruction suits schools

Files with BSN, health data or behavioural notes should not leave school in an unsealed bin. On-site shredding solves this: the truck stands in the car park, boxes go from archive straight into the hopper, and you receive a certificate with date, weight and method. For the parent who later asks "where is that file?", you have proof of correct handling.

Digital copies: do not forget the USB stick

Many schools have digital backups on USB or external drive alongside the paper file. For disposal, H-4 (or higher) applies for magnetic media and E-4 for electronic storage. Simply "format and throw away" is not destruction in GDPR terms; the data is recoverable. A mobile destruction partner takes these items in the same session.

Checklist: do you have these in order?

• A retention period list per file type (one A4 will do).
• A fixed annual cycle for clearing expired files.
• Arrangements with a destruction partner that can come to the school.
• Archiving of certificates in your records of processing.
• Internal communication to teachers: what to keep, what to remove?

---

See our industry page Document destruction for schools. Or just send us your question; we know which papers float around a typical school.