Data lurking everywhere? Time for a cleanse? Helen Burge talks about how to instigate and manage a school-wide data cleanup – without the stress!
A long time ago when I started as a bursar at a new school, I had the enviable task of reviewing two full to bursting filing cabinets and making the decisions about what to keep and what to shred. This was pre GDPR, so I’m sure I unintentionally disposed of some data which should have been retained at the time.
These days starting in a new role is unlikely to involve reviewing physical data records via two filing cabinets. In the age of digital transformation, schools are awash with data – from pupil records and safeguarding notes to finance systems and cloud-based learning platforms, suggesting the review task is on an even larger scale.
Data as an Estate
Visualise your school’s data as an estate. Is it neat and tidy with those responsible for data tending to it correctly? Or does your school data estate sprawl into wild unchartered landscapes that no one wants to access or in the case of legacy systems is unable to access. Are those that tend your school’s data estate, applying consistent practices or are they unaware or ignoring their data responsibilities?
Now you’ve visualised it, how are you going to tidy it without triggering resistance or operational disruption? Try following this pathway through your data estate:
Step 1: Why?
Having clarity about why you are asking others to cleanse data is important as it will help with their engagement with the task. Reasons may include:
- preparing for an upcoming audit
- reducing cyber risk
- improve operational efficiency
- aligning with GDPR and ICO guidance
- less of a data trawl for the next subject access request
- reducing data storage to reduce costs and carbon footprint
Communicate the vision to staff linking it to real-world examples – like a misplaced safeguarding record or outdated emergency contact – to show how poor data hygiene can have serious consequences.
Step 2: Map your data estate
You can’t clean what you can’t see. Begin by mapping out where data lives across the school, this might involve reviewing or creating a Record of Processing Activities (ROPA). This document is required under GDPR regulations and outlines how the school processes personal data. Consider your:
- Systems: MIS, finance software, HR platforms, safeguarding portals, cloud storage, email archives
- Formats: Digital files, paper records
- Owners: Who creates, uses, and stores the data?
This mapping exercise will identify data hotspots, overlaps, and risks. Involve admin teams, IT staff, and department leads to build a shared picture.
Step 3: Apply “ROT”
Once you’ve mapped your data, apply the ROT test:
- Redundant: Duplicated files, old versions, unnecessary backups
- Outdated: Records past their retention period, obsolete formats
- Trivial: Personal notes, irrelevant emails, non-school content
This test helps staff make quick, confident decisions without needing to be data protection experts. Provide copies of your retention schedule and safeguarding protocols before deletion.
Step 4: Provide structured guidance
Avoid vague instructions like “delete your old emails.” Instead, provide structured guidance:
Checklists for specific departments (e.g., finance, SEN, HR)
Folder naming conventions to support consistency
Requests to save files in drives rather than use emails for file storage and to send links within drives to prevent document duplication and helps retain the data in a controlled environment
FAQs addressing common concerns (“Can I delete old governor emails?”)
Make these resources accessible and jargon-free. Where possible, align with existing policies—don’t reinvent the wheel.
Step 5: Create a data clean culture
Share the vision of a clean and tidy data estate and start building a cultural shift, this isn’t a one-off task. Engage staff as co-owners:
- Track your progress and report widely. Size of data at the start, amount saved. This will help staff see the results of their work
- Celebrate progress – “We’ve reduced our shared drive by 40% since September!”
Consider appointing “data champions” in each team—people who can support peers, escalate issues, and model good practice. This will also help build internal capacity for future audits, inspections, and digital transformation projects.
Step 6: Deeper controls
While staff tackle front-end files, IT teams should review:
Access controls: Who can see what, and why?
Backups: Are you retaining deleted data longer than necessary?
Legacy systems: Are old platforms still storing sensitive data? Sometimes its quicker and easier to decommission a legacy system and delete all data rather than clean it. Also added advantages of reducing the ongoing cost of maintenance of your technology estate.
Third-party processors: Are contracts and data sharing agreements up to date?
Step 7: Embed the data clean culture
Now you’ve created a data estate which is manageable and tame, you need to embed the management of the data estate into your school’s rhythm and culture. Add data hygiene to:
- Annual policy reviews
- Staff induction and training
- Internal audit cycles
- Governor / Trustee reporting
Running a school-wide data clean-up doesn’t have to be chaotic. With the right framing, tools, and culture, it becomes a strategic enabler – reducing risk, improving efficiency and strengthening trust. Having to clean up data can be an enabler for the possible implementation of AI tools to make the right data available for your teams. In a world where data breaches and compliance failures can erode reputations overnight, schools that treat data as an asset – not a burden – will be better placed to lead with integrity.
So, grab your digital broom, rally your team and turn clutter into clarity!
Be the first to comment