Anyone who dreams of a paperless society would probably weep if they saw the behind-the-scenes records of the average school or college. The implementation of GDPR highlighted the struggles faced by schools, which need to ensure a high level of data security while staying within their (often tight) budgets.
Even though GDPR has raised the bar on data security, the good news is that GDPR compliance can normally be achieved without too much effort or expense. The change from EU-GDPR to UK-GDPR (which is almost identical), therefore seems like a good time to recap on good practice regarding document archiving for education.
All schools, colleges and universities should already be GDPR-compliant. In fact, they should have been GDPR-compliant for at least two years.
Blog Contents:
Clearing out the old
The average school or college tends to be a place where people have an awful lot to do and very little time or money with which to do it.
Therefore, it’s entirely understandable that people let irrelevant “stuff” accumulate within Schools. Unfortunately, that “stuff” can be a security hazard, even if it doesn’t seem that way. Remember, for as long as sensitive data exists, it is a security risk.
Old school computers, stuck into cupboards as spares or for parts, will probably still have their hard drives. Do you know what’s on them? Unless you are sure that they are clean of all personal student and staff data, it’s time to get rid of them (or at least the hard drives) and you can’t just dump them into regular waste.
Hard Drives
Data on old hard drives is either needed or it’s not. If it’s needed it should be stored securely. That’s definitely not on an ageing hard drive. If it’s not needed it should be deleted. If you’re not sure, move the data onto a more reliable hard drive and have the old disk wiped. Then make it a priority to work out what to do with the data.
Remember, for as long as sensitive data exists, it is a security risk.
Likewise, clean up any old storage media. Exactly the same comments apply to any old storage media and for exactly the same reasons.
Leaving aside environment concerns, you cannot risk a hard drive being recovered and read (however unlikely that may seem). You need to use a proper shredding service.
Similar comments apply to other IT equipment, unless you are 100% sure that it has never contained any personal data which could be accessed by an IT-literate person, then you need to hand it over to the professionals who are experts when it comes to document management for the education sector.
Sort, shred, archive and file your remaining paperwork
If you still have piles of old paperwork waiting to be dealt with, then it’s time to deal with it. Your priority should be managing and storing student records, staff records and financial records.
Even though it can be difficult to decide how long some records need to be kept, the decision does have to be taken (and the result of it could be a whole lot of extra storage space for your school or college).
Once you have identified what school documents need shredding, handing it over to a professional document shredding company not only saves you (and your staff) a job, it ensures that the job is done properly and gives you a record of its having been done.
Shred pupil records unless there is a clear reason for keeping it. On a short-term basis, it’s fine to keep paperwork on a “just-in-case” basis, but you should then make a point of clarifying whether or not it is actually needed and then act as necessary.
If you can’t work out whether or not something is necessary, then you have a serious issue with your data-collection process and need to address it.
Your second-choice option should be to archive your paperwork. In other words, put it into cold-storage, potentially off-site. If you have a digital copy of the paperwork, then you’re highly unlikely to need to reference the original.
You might still need or want to keep it for legal/compliance reasons or in case anything happens to the digital copy, but you’re unlikely to need it quickly. If anything remains, then file it somewhere easily accessible, but be ready to move it on when it ceases to be needed actively.
Digitise existing paperwork
Many educational institutions will be at least moving towards digital data capture. At present, however, it is not always practical to capture all data in digital form. For example, some documents require signatures and even now the easiest and most effective way to collect these is generally on paper.
If the document has legal implications, then it may need to be kept on paper. There is, however, no harm in taking a digital copy as well. In fact, doing so can often make life a lot easier for everyone.
It’s up to you whether or not you use the digitisation process as an opportunity to organise your physical paperwork. One way to balance speed of digitisation with speed of organisation is to macro-sort. Just assign broad categories and dump the paperwork into it as you work. It’s fine if some papers end up in the wrong category.
You can fix this when you go through them later and sort them properly.
Undertake regular data cleansing to keep up the good work
Spectacular transformations can make for great TV, but in reality, they’re usually massively disruptive (even if in a good way), hence tackling tasks “little and often” is generally much to be preferred. The keys to successful GDPR implementation are as follows:
- Collect only what you need
- Keep it only for as long as you need it
- Know where it is kept
- Know who has access to it
- Have a process for deleting it completely when it is no longer needed
Unfortunately for schools, colleges and universities they often have a legitimate need to collect a substantial quantity of personal data, which is why the last three points are so important. Points three and four are generally a matter for school/college staff, but it is usually best to have experts manage the disposal of expired data.
Start the term with a clear desk
If you feel your school, college or university could benefit from help and advice from an off-site storage facility, we can help! Save time and money in your educational institution with our range of document management services.
Feel free to get in touch with our team. We can explain in more details the service and benefits you would receive as well as the different types of documents you can store in our security facility.
Looking for something else? We can also provide other document management services including, document scanning and document shredding.