Pupil Records and GDPR: Shredding Guidance for Welsh Schools

Your school produces confidential paper in places an office never would. Not just your school office, but every classroom, the staff room, the SENCo's cupboard, the safeguarding file, the medical room, the trip folder in a teacher's bag. Every one of those pieces of paper is about a child in your care, which raises the stakes on getting disposal right.

Children's data raises the bar

The UK GDPR treats children's personal data as deserving specific protection, and the ICO expects that to be reflected in how you handle it. Some records contain special-category information, such as health, ethnicity, religion or disability data. Medical records will normally qualify; safeguarding and additional-learning-needs files often contain such information, but the classification depends on their actual contents rather than the file label alone.

The ICO's audit guidance recommends secure storage before destruction, suitable methods such as cross-cut shredding or incineration, appropriate third-party contracts and evidence such as audit checks or destruction certificates. Welsh Government school guidance specifically recommends cross-cut shredding for personal or sensitive records. The recycling box in the corner of your staff room meets none of that, and it's where a great deal of confidential school paper ends up.

The classroom problem

Your school office is usually fine. It's the rest of your building that leaks. Marked work with names on it. Class lists photocopied for a trip. Seating plans annotated with information about individual children. Behaviour logs. Medical and allergy lists pinned up and then taken down. Consent forms. Assessment printouts.

All of it is personal data about identifiable children, and most of it is generated a long way from your nearest secure bin, by staff with about ninety seconds between one lesson and the next. Which means your practical answer is not more training. It's more bins, closer to where your paper is actually made.

The retention question, honestly handled

How long you must keep a given record depends on the record type, and the periods vary enormously. A pupil's main educational record follows one rule, safeguarding files another, financial records another again, and some are held long past the pupil leaving.

We destroy confidential waste for a living; we're not an information governance service. Your retention schedule should come from Welsh Government and local authority guidance and your own data protection officer, not from a pest control and shredding company's blog. What we can do for you is destroy what your schedule says is due, and give you a certificate proving it happened. For the general commercial timescales, our guide to how long to keep business records covers the everyday material.

What works in a school year

Locked consoles in the office, the staff room and the photocopier area at minimum, because those three cover most of the volume. A collection rhythm that matches your school year rather than a flat monthly slot: your summer term end generates far more than February does. A bulk clear-out slot for your archive when the site is quiet and nobody is teaching. And a clear instruction that nothing with a child's name goes in the ordinary recycling, ever, including work being cleared off the wall.

The category you'll forget is hardware: old laptops, tablets, memory sticks and the office machine you replaced three years ago that's still under a desk. Electronic devices require secure erasure or physical destruction and may need a separate WEEE or hazardous-waste stream. Confirm the provider's authorisations, method, transfer documentation and destruction evidence before combining services.

More on how we work with education settings is on our schools and childcare page, and on the service itself on our confidential waste destruction page.

Get in touch

Want consoles in the right rooms and collections that fit the school calendar? Get in touch and we'll set it up around your site.