Decide how long you keep a student file.

Ask an agency owner how long they keep student records and the usual answer is a pause followed by "we still have everything". That is not a retention policy. It is the absence of one, and it carries real cost: more personal data to secure, more to hand over if it is ever demanded, more to lose in a breach, and no defensible answer when a former student asks why you still hold their medical certificate from four years ago.

Two decisions, not one.

How long you keep each class of record, and what happens when that period ends. Most policies specify the first and are silent on the second, which is how "retain for three years" becomes "retain for ever" in practice.

Classes, not files.

A student file is not one thing with one lifetime. Break it into classes and give each its own period.

• Identity documents — passport scans, birth certificates. High sensitivity, no ongoing purpose once the journey is complete. These should have the shortest period of anything you hold.
• Academic and test documents. Longer, because a former student may need a copy and because institutions ask retrospectively.
• Signed agreements and fee disclosures. Long, because they define obligations that can be disputed years later.
• Counselling notes and correspondence. Long enough to answer a complaint, and complaints arrive late.
• Financial records — invoices, commission statements, receipts. Governed by tax and accounting law in your jurisdiction, which usually sets the longest period in the whole policy.
• Health and medical documents. Shortest possible. Delete as soon as the purpose ends.

Start the clock at the right event.

"Three years" from what? Enquiry, enrolment, last contact, end of the course? Pick the trigger explicitly for each class, and prefer a trigger the system already records. "Three years from the closure of the student's last active application" is enforceable by software. "Three years after we stop dealing with them" is not.

What happens at the end.

Three options, and each should be a deliberate choice per class: delete, anonymise, or archive with restricted access. Anonymising is underused and often the right answer — stripping identifiers from an old file keeps the statistics that let you see conversion trends across five years while removing the personal data you no longer have a reason to hold.

Whatever the choice, it has to be executed and recorded. A policy that says records are deleted after five years, in an agency where nothing has ever been deleted, is worse than no policy: it is a written statement that you are not doing what you said.

The awkward interactions.

1. 01A deletion request from a former student, where you also have a legal obligation to keep financial records. Both are real. Know which records each covers and be able to explain the split.
2. 02A live dispute or complaint. Suspend deletion for the records concerned until it is closed, and record that you did.
3. 03Backups. A record deleted from the live system that persists in backups for another year is a normal, defensible position — but only if your policy states the backup retention period rather than pretending backups do not exist.
4. 04Departing staff. Records held in a personal inbox or a personal drive are outside every policy you have. This is the most common failure and the least discussed.

Review it on a date, not on an instinct.

Put an annual review in the calendar, with a named owner. Check that the periods still match the law, that deletions actually ran, and that the classes still describe what you hold — agencies acquire new categories of document constantly, and a policy written before you started selling connectivity or handling medical results says nothing about them.

Tell students at the start.

Your consent copy should say how long you keep their records and why, in the second person, before they hand anything over. It reads better than it sounds, it costs two sentences, and it converts an awkward conversation four years later into a reference to something they already agreed to.