Good records management tends to be overlooked until something goes wrong. A subject access request arrives, a grievance is raised, or an audit is triggered – and suddenly the gaps become apparent. But with a few practical steps, schools can get ahead of the problem.

Establishing a clear filing structure

The first question to ask is simple: does every line manager in your organisation know where employee records should be stored?

Think carefully about how records are currently held. In many schools, while technology has changed rapidly, records management practices haven't kept pace. Many will remember the paper personnel file; a single, physical location for everything relating to a member of staff.

The digital transition has brought enormous benefits, but it's also created a real challenge: records are now scattered across email inboxes, individual cloud storage folders, shared drives and HR systems. Effectively, almost every employee with access to IT systems has become an accidental records manager.

Return to work interviews, appraisals, grievances and disciplinaries should all be filed consistently and in a single, logical and accessible location for each member of staff. You don't need expensive software to achieve this. A well-organised shared file system with a clear and consistent folder structure works just as well, provided everyone understands and follows it.

Why records management matters for subject access requests

When a member of staff moves on or is absent, records stored in personal email accounts or cloud storage can quickly become inaccessible. The consequences are particularly acute when a Subject Access Request (SAR) is received.

When a current or former employee submits a SAR, the organisation must search all locations where that individual's personal data is likely to be held. If records are dispersed across personal inboxes and individual storage accounts, those searches become wide-ranging, time-consuming and costly. The risk of data being missed or incorrectly disclosed also increases significantly.

The more disciplined and consistent your approach to filing, the more you can legitimately limit the scope of your SAR searches. Thanks to amendments to the UK GDPR introduced by the Data (Use and Access) Act 2025, it's now confirmed in law that controllers are only required to undertake "reasonable and proportionate" searches. 

If your records management is robust and staff data is reliably stored in defined locations, you can confidently restrict your searches accordingly. Poor records management removes that ability. If data is stored without structure, you can't reasonably argue that a narrow search was sufficient.

New record retention requirements from April 2026

From April 2026, employers are required to retain records evidencing compliance with workers' statutory paid annual leave entitlements under the Working Time Regulations 1998, for six years from the date those records were made. For many organisations, existing retention schedules will need updating as many have historically applied a three-year retention period.

This new obligation is a useful prompt to take stock of your records management approach more broadly. Review and update your retention policy and schedule, and the guidance you provide to staff about how and where records should be stored.

Our expertise

A policy on a shelf serves little purpose if the people managing records across your organisation aren't aware of it or aren't following it in practice. Our Data protection support pack for schools contains two key documents you need to get this project underway.