Retention of student records

University of Oxford

Guidance on how long to retain student records

Why we need a data retention policy?

- We need to comply with the requirement of the Data Protection Act that personal data is not kept for longer than necessary. If we retain personal data for longer than we need to, we will also breach the requirement that personal data must be relevant for our purposes and not excessive.

- We need to keep data for as long as it is required to manage operational activities.

- We need to make best use of storage space, both physical and digital.


- This guidance seeks to provide indicative guidance for those responsible for managing student records and student administration.

- It covers the main corporate systems such as SITS, CMIS,GSS, OXCORT, DWH, and local Access databases, Excel spreadsheets, email and paper, for example, interview scores held locally in a departmental database.

- Data extracted from master systems and stored in local drives or email, should be destroyed after use, and care should be taken to ensure data is not held for any longer than necessary.

- EXCLUDED: retention guidelines for maintaining transactional records, for example retention of requests for transcripts.

Retention periods

- The master copy of data should not be deleted before the expiry of the retention period. Supplementary copies (eg Excel downloads, or working files) may be deleted before retention period if they no longer serve a purpose. Careful consideration should be given as to whether supplementary copies of data should be held or could be destroyed.

- When the retention period is reached, the data should be destroyed as soon as practicable and in a secure manner.  For further information please contact Data Quality Team (

Last reviewed January 2018

Issued by Student Registry

A detailed Guide (115kb) sets out how long to retain student records.