The purpose of this Guidance is to ensure that necessary records and documents of the programme are adequately protected and maintained and to ensure that records that are no longer needed by the National Early Roll-out of the Early Career Framework are discarded at the proper time.
Data retained for business purposes will be registered on an Information Asset Register maintained within the DfE and will be reviewed quarterly by the Information Asset Owner (IAO). Records and data held centrally will not be duplicated and will be stored digitally in a DfE approved secure location.
2. Policy Principles
All data will be retained for no longer than necessary in accordance with the timescales detailed in this Guidance. The National Early Roll-out of the Early Career Framework IAO is responsible for regulating the retention period for data under this project in line with the DfE Retention and Disposal Schedule.
For specific advice on how long to retain certain data, the National Early Roll-out of the Early Career Framework IAO will be the first point of contact, or alternatively the Privacy Assurance Team in the Data Protection Office.
The personal and or special category data that will be retained for the National Early Roll-out of the Early Career Framework includes:
- IP Address of User
The DPA and GDPR require that personal data should not be excessive and kept no longer than is necessary for the purposes for which it is required. The National Early Roll-out of the Early Career Framework will only keep personal data for up to 2 years, which is as long as is needed to allow cyber security defence and technical monitoring of the platform itself, administrative audit of editing activity and Google Analytics of the site visitors. After this period, it will be destroyed.
Under data protection legislation and in compliance with the relevant data processing conditions, The National Early Roll-out of the Early Career Framework can lawfully keep personal data processed purely for research and statistical purposes indefinitely.
4. Disposal of data
When the retention period for identifying data relating to The National Early Roll-out of the Early Career Framework has expired and a review indicates personal data is no longer needed, all electronically stored data will be deleted and removed from DfE systems and any identifying data existing as a hard copy will destroyed in line with DfE procedures. All versions (backup, portable, interim) of the data will also be deleted in a manner that they cannot be recovered.
Where data is managed by a processor on behalf of the department, we will obtain evidence of deletion by requesting confirmation in writing or any other method specified under contracts or agreement with the third party.
Any personal data retained for archiving, scientific, historic or statistical purposes will be anonymised* before being kept indefinitely.
This Retention Document will be reviewed annually.
* The principles of data protection do not apply to anonymous information, namely information which does not relate to an identified or identifiable natural person or to personal data rendered anonymous in such a manner that the data subject is not or no longer identifiable. This Regulation does not therefore concern the processing of such anonymous information, including for statistical or research purposes.”