Education

Tutoring services: destroying student data

1 August 2026 · 10 min read · DeSnipperaar

A tutoring service works with data about students who are often minors and with data about their parents. Think of contact details, the school and level, progress and result reports, planning and payment data. Part falls under the tax retention obligation, but the largest part has no statutory retention period and should be kept as briefly as possible. This guide shows, by part, what you keep, on what ground, when it may go and how to destroy it confidentially.

The quick answer: invoicing and payment data fall under the tax seven years. Progress and result data you keep no longer than necessary for the tuition. For a student under sixteen, parental consent is the ground for whatever is not strictly needed for the agreement. What may go disappears confidentially and with a certificate.

Ground and parental consent

At a tutoring service the student is usually a minor. For children under sixteen it is not the child but the parent or guardian who gives consent for processing that rests on consent. For the core of your service, giving tuition on the basis of an agreement, the ground is the performance of that agreement. For anything beyond that, such as keeping results for later or using data for promotion, you need a separate ground and that is often consent.

So record what you asked for and obtained consent for. A parent may also withdraw that consent, and then the related processing stops. Whoever keeps the distinction between agreement and consent clear knows exactly which data disappear at the end of the programme and which remain a little longer for a tax reason.

Retention periods by part

The period differs per type of data. The overview below gives the main line. Count the tax period from the end of the financial year and the other periods from the end of the tuition programme.

Part	Starting point	Period
Invoicing and payment data	Tax retention obligation	7 years
Student and parent contact details	While the programme runs	until the programme ends
Progress and result reports	Purpose-bound tuition	as briefly as possible
Tests, notes and homework	No retention obligation	clear out afterwards
Consents and intake forms	As long as needed as proof	purpose-bound
Correspondence and drafts	No retention obligation	clear out at once

Use this as a guideline, not as a hard rule for every file. When in doubt, consult your privacy adviser. A broader overview by type of document is in the GDPR retention periods cheatsheet and in how long to keep documents.

Data on minors: extra care

Data on children calls for extra restraint. At intake collect only what you need to give the tuition, such as the level, the subject and the learning goals. A copy of an identity document or a national ID number is something a tutoring service almost never needs. If you do ask for it, keep it no longer than strictly necessary and clear it out confidentially afterwards.

The approach resembles what schools and childcare do. How a school handles student files is in schools: keeping student files for five years, and the careful handling of children's data returns in childcare: destroying child and parent records.

Progress reports and results

A tutoring service records how a student develops. Progress notes, test results and reports to parents are useful during the programme, but they lose their purpose as soon as the tuition stops. Do not keep them in case the student ever returns, because that is not a valid ground. Share reports only with the parent where that is agreed and keep sensitive notes, such as remarks about concentration or a diagnosis, recognisably separate. Such information can touch on health data and deserves extra care.

How to handle it in 6 steps

1. Split the data into administration, contact details, progress and consents.
2. Limit the intake to what you need for the tuition.
3. Record consent from the parent for a student under sixteen.
4. Clear out progress and tests as soon as the programme is finished.
5. Collect what may go in sealed containers, not in the paper bin.
6. Have it destroyed confidentially with a certificate and record it in your register.

Destroy confidentially with a certificate

Student and parent data is destroyed confidentially, because it contains contact, payment and sometimes sensitive data on minors. The paper and any data carriers travel sealed and stay that way until destruction, so the chain is closed. An old laptop, phone or backup with student data belongs with it too. The same care applies at related teaching organisations, as you see in driving schools: destroying pupil data.

Afterwards you receive a certificate of destruction with the date, quantity and level. That certificate is your proof towards the GDPR that you acted carefully. Record the destruction in your record of processing. We collect within 20 km of Amsterdam with no call-out charge, work nationwide through pooled collection rounds and charge a fixed price per box or roll container. Drop-off on site is not possible; it works by appointment through collection.

Common mistakes

• Asking too much at intake. Collect only what the tuition really needs.
• Keeping progress forever. After the programme ends the purpose lapses.
• Not recording consent. Without a record you cannot demonstrate the ground.
• Treating sensitive notes as ordinary paper. Those need extra care.
• Throwing away unshredded. Student data on the street is a reportable data breach.

Frequently asked questions

Do I need parental consent to process student data?

For a student under sixteen you ask the parent or guardian for consent. That consent is the ground for data not needed to perform the agreement. Record what you have consent for and respect a withdrawal.

How long may a tutoring service keep student data?

Invoicing and payment data fall under the seven-year tax retention obligation. Progress and result data you keep no longer than necessary for the tuition and clear out after the programme ends.

How do I handle progress reports and results?

Use them only for the tuition and share them with the parent where that is agreed. Do not keep them longer than the programme and clear out tests, reports and notes confidentially afterwards.

How do I destroy student and parent data in line with the GDPR?

Confidentially and with a certificate of destruction. Paper and data carriers travel sealed and the destruction is recorded in the record of processing.

Conclusion

A tutoring service works with data on students who are often minors and on their parents, between a tax retention obligation and the GDPR. Limit the intake to what is needed, record parental consent for a student under sixteen and keep progress and results no longer than the tuition. The administration you keep for seven years. What may go you have destroyed confidentially with a certificate as proof. That way you protect your students' data and meet the GDPR.

Read also: universities: destroying student data, training providers: destroying participant data, exam bodies: destroying candidate data and the GDPR retention periods cheatsheet.

---

Have student data collected? Request a quote via desnipperaar.nl. Within a few minutes you have a fixed price, including a certificate as proof.