The keeping, disposal, disclosure and transfer of educational records

This guidance, underpinned by regulations, applies to schools and local authorities, and their duties regarding the handling, transfer and access arrangements for school educational records. It takes account of the Freedom of Information Act 2000 and the UK General Data Protection Regulation (UK GDPR), implemented by the Data Protection Act 2018.

It is important that schools understand what constitutes an educational record and the legal responsibilities related to the secure transfer of pupil information. This includes the information that must be transferred when a pupil changes school, as well as the information that is provided to parents in school based reports; or following requests made to schools.

An educational record is defined in the The Pupil Information (Wales) Regulations 2011 (legislation.gov.uk) as any record of information, including a pupil’s curricular record, which includes a pupil’s academic achievements, other skills, abilities and their progress in schools. Copies of pupil reports form part of the educational record. All pupils will be entitled to have their educational records disclosed to them on written request.

Changes made by the UK General Data Protection Regulation (UK GDPR), implemented by the Data Protection Act 2018 (‘the data protection legislation’) and the Freedom of Information Act

Before data protection legislation first came into force in 1998, parents had a general right to see their child’s educational record, as long as the child was aged under 18; and pupils themselves had a right to see manual records, as long as they were aged 16 or over. Under current legislation, the right of parents to see their child's records remains essentially the same, but the right of the pupil to see the record is different. It is no longer related to the age of the child. Instead, children who submit written requests to see their records should be allowed to do so.

Children have the same rights as adults over their personal data. These include the rights to access their personal data; request rectification; object to processing and have their personal data erased. The concept of competence (the child’s capacity to understand the implications of their decisions) remains as valid under the GDPR as under the 1998 Act. If a child is not competent to exercise their own data protection rights or consent to processing themselves then it will usually be in their best interests to allow an individual with parental responsibility to act on their behalf. If a child is competent then your overriding consideration should still be what is in their best interests however, in most cases it should be appropriate to let the child act for themselves.

Schools should not disclose anything about a pupil’s educational record which would be likely to cause serious harm to their physical or mental health or that of anyone else - including anything which suggests that they are, or have been, either the subject of, or at risk of, child abuse.

Since 1 January 2005, any person has had a legal right to ask a school or local authority for access to information held by that school or local authority under the Freedom of Information Act. Schools and local authorities are under a duty to provide advice and assistance to persons requesting information. Requests must be made in writing. Information that is not covered by the UK GDPR (e.g. personal data) is automatically covered by the FoIA.

Schools should have a policy in place for the management of educational records. This policy should be reviewed at regular intervals (at least once every three years).

The Information Commissioner's Office (ICO) is an independent body with responsibility for upholding information rights, and can offer further advice on the management of records and the handling of requests for information.

Disclosure of a pupil’s educational records

Records must be disclosed upon receipt of a written request from either a pupil or parent in the case of:

• pupils aged 17 and under, both the pupil and parents may request to see the school record
• pupils aged 18 or over, only the pupil may request to see their school record, with the exception of appropriate circumstances where this may be the parent - for example in cases of pupils with additional learning needs

Educational records must be made available or be disclosed within 15 school days upon receipt of a written request from a parent or pupil, to view or obtain a copy of an educational record. If the pupil or parent regards any part of the pupil’s educational record to be inaccurate, it is the responsibility of the governing body to correct or remove the corresponding information from the record. Headteachers must make an educational record available for a parent to view free of charge. If a parent requests a hard copy of an educational record, the headteacher is permitted to charge a fee that does not exceed the cost of supplying the record. Headteachers may exclude certain confidential information from being disclosed.

Retention of educational records

Under the Freedom of Information Act 2000, schools are required to maintain a retention schedule listing the record series which a maintained school creates in the course of its business. It refers to all information, regardless of the media in which they are stored. A sample retention schedule is published alongside this guidance, with timescales for retention of various records and the action which should be taken when it is of no further administrative use. Whilst some retention periods may be governed by statute, others are guidelines following best practice. This is an example schedule that includes school records associated with the Welsh Government’s Information Management Strategy. Schools and local authorities are however responsible for determining their own retention schedules. Other examples of more general school retention schedules are available, including a checklist produced by the Information Records Management Service.

In accordance with: The Head Teacher’s Report to Parents and Adult Pupils (Wales) Regulations 2011:

• headteachers must ensure that a written report is sent at least once during the school year, to the parents of each pupil, for their retention. Where parents are separated, schools should take this into account (except when precluded by a court order), and have systems in place to deal with dual addresses
• the timing of the report is entirely at the headteacher’s discretion, provided that all the required information is sent to parents by the end of the school year. Where the headteacher decides to send a single written report each year, it must contain the full information required by the Regulations. If the headteacher decides to send more than one written report during the course of a school year, the information required by the Regulations may be spread across more than one report
• examination results that are published during the summer holidays must be reported after the school year in which the examinations have been taken, but not later than 30 September
• there is a required minimum of information that must be reported to parents each year. The content of the report varies according to the pupil’s age and progress through the Curriculum for Wales. Reports should include any information that has been provided by an employee of the local authority that maintains the school (including education welfare officers); a teacher or other employee in voluntary aided and grant maintained schools (including educational psychologists contracted by the governing body as part of the whole school approach on supporting the mental health and wellbeing of children and young people)
• headteachers are required to provide all pupils over compulsory school age who are proposing to leave, or have left the school, a report on their school achievements (‘school leaver’s report’). it is the responsibility of headteachers to determine the format of reports sent to parents, but in doing so are strongly encouraged to seek the views of governors, parents and pupils wherever possible
• where it appears appropriate to do so, headteachers should arrange for the report to be translated into languages other than Welsh or English. They are also required, where appropriate, to produce the report in Braille or in an audio format. No charge should be made for a copy of a report translated or produced in accordance with the Regulations

When reporting to parents, headteachers must exclude information:

• that can identify a person other than the pupil to whom the information relates
• which in the headteacher’s opinion would be likely to cause serious physical, mental health or emotional harm to the pupil concerned, or to any other person
• that could have a bearing on a case of child abuse or the risk of it
• that would serve to disclose information about a pupil, other than the pupil being reported on
• in relation to any school comparative information

Parental requests for information

When receiving requests for information, all parents or those with parental responsibility should be treated equally by schools and local authorities. This is irrespective of where the child lives, unless there is a court order limiting the individual’s exercise of parental responsibility.

Parents have a right to request written information about their child’s level of attainment in all subjects in which they are assessed, and headteachers must provide this information within fifteen school days of the request.

When pupils transfer from one school to another, it is important that the ‘new’ school has, and is able to act on, information about them. The common transfer system (CTS), underpinned by the Education (Pupil Information) (Wales) Regulations 2004, provides for the secure, electronic transfer of pupil information when pupils move school. Schools (or local authorities in specific circumstances), can create an electronic file known as a Common Transfer File (CTF), containing personal and assessment pupil information from the school’s management information system (MIS). Whenever a pupil joins a school from another school within Wales or England, they must be accompanied by a CTF, which must then be sent to the pupil’s next school for direct import to their MIS. (Pupils moving to from schools in Scotland, Northern Ireland or outside the UK will not necessarily have a CTF).

Children missing education are of particular concern because it is not just the child’s education that is at risk, but also potentially their safety and welfare. Children and young people can go missing from education for a variety of reasons. Local authorities should put in place procedures designed to monitor the whereabouts of a child at risk of going missing from education and to record that they have completed these procedures. Revised statutory guidance was published in 2017, in order to help prevent children and young people from missing education. The document sets out guidance for local authorities on arrangements that will enable them to establish the identities of children residing in their area who are not receiving a ‘suitable education’.

The 'Lost Pupil Database' is a searchable area of the s2s website containing Common Transfer Files of pupils where the destination (or next) school of the pupil is not known to the school the pupil is leaving. In order to avoid duplication of CTFs, if a school uploads a file to the Lost Pupil Database and is subsequently contacted by the pupil’s new school, they should always direct them to the Lost Pupil Database area of s2s. They should not create a new CTF.