Tru Data Protection

Email Deletion

A practical article for schools on email deletion, retention, SAR workload and why email should not become the long-term filing system.

Schools are seeing an increase in parental Subject Access Requests, sometimes arriving with a tense or urgent tone.

These requests can be demanding, especially where schools have long email histories. A search of historic mailboxes can quickly produce thousands of pages that need review and redaction.

Email retention is therefore not just an IT issue. It is a data protection, records management and workload issue.

At Tru Data Protection, we often see schools carrying years of email in personal mailboxes because nobody has defined what should be kept, what should be moved to proper records, and what should be deleted.

The challenge

When a Subject Access Request arrives, schools may ask IT to search email accounts for relevant information.

This can result in:

  • thousands of emails;
  • duplicate threads;
  • irrelevant messages;
  • attachments;
  • informal comments;
  • historic records;
  • third-party personal data;
  • safeguarding or HR content.

All of that material may need review before disclosure.

Email should not be the filing system

Many staff use email as a filing system because it feels familiar and searchable.

But this creates risks:

  • important records may be hard to locate;
  • information may be stored in personal mailboxes rather than proper systems;
  • retention becomes inconsistent;
  • old data accumulates without purpose;
  • former staff mailboxes become data risks;
  • SAR searches become larger and more expensive;
  • security risks increase if accounts are compromised.

Email is useful for communication. It is not ideal as the long-term record store.

What should be kept?

Schools should identify which emails are genuine records and move them to the right system.

For example:

  • safeguarding concerns should be recorded in the safeguarding system;
  • behaviour records should be stored in the behaviour system;
  • SEND records should be stored in the SEND record;
  • HR records should be stored in HR files;
  • complaints should be stored in the complaint record;
  • governance decisions should be stored with the relevant evidence.

Once the record has been stored properly, the email copy may no longer need to be retained indefinitely.

Practical step 1: create a simple filing rule

Create a simple policy or staff guidance note.

It should explain:

  • which emails need to be kept;
  • where they should be stored;
  • who is responsible for filing them;
  • when email copies can be deleted;
  • what not to store in email;
  • how long email should normally be retained.

This does not need to be complex. It needs to be clear enough for staff to follow.

Practical step 2: set automatic deletion

Ask IT support to consider automatic deletion after a defined period, such as three months, six months or another period that fits the school’s retention policy.

This encourages staff to file important records properly.

It also reduces:

  • inbox clutter;
  • historic data risk;
  • SAR review volumes;
  • security exposure;
  • legacy mailboxes from former staff.

Automatic deletion should be introduced carefully, with staff guidance and senior approval.

Why this helps with SARs

A Subject Access Request may require the school to search for personal data.

If key records are stored properly and old emails are lawfully deleted under a retention policy, the school is in a much better position.

The school can search relevant systems and records rather than relying on years of accumulated email.

If emails have been deleted in line with a clear retention policy, that is not a problem. Organisations are not expected to keep everything forever.

Be bold, but be controlled

Deleting old email can feel risky. But keeping everything forever is also risky.

The better approach is:

  • decide what records need to be kept;
  • store them in the right place;
  • document the retention rule;
  • train staff;
  • apply deletion consistently;
  • review the policy periodically.

How Tru Data Protection helps

Tru Data Protection helps schools and MATs review retention practice, improve email governance and reduce the burden created by poor information management.

That can include:

  • retention and deletion guidance;
  • SAR support;
  • records management advice;
  • policy wording;
  • staff guidance;
  • practical governance review.

Conclusion

Email deletion is not about hiding information. It is about keeping the right information in the right place for the right length of time.

Good email retention reduces risk, improves SAR handling and helps schools manage information more confidently.