Records Management

Policy

The purpose of this policy is to assist schools to understand and meet requirements for creating, managing, storing, and disposing of school records.

Summary

• School staff must create, safeguard and store school administration and student records in accordance with this policy.
• School principals are the delegated custodians of their school’s records and are responsible for compliance with this policy and guidance.
• Schools must create and manage new records in digital formats whenever practicable and avoid creating and managing records in hardcopy.
• Schools must retain and manage records for the minimum retention periods outlined in the School records retention guide.
• Records must only be disposed of with written approval of the school’s principal after their minimum retention period has been met.
• Certain records may be routinely disposed of as part of Normal Administrative Practice without formal approval from the school principal, such as duplicate copies, working documents and drafts.
• School principals must ensure that the disposal of records is planned and conducted periodically (for example, annually) and in accordance with this policy.
• Schools planning to digitise and then destroy hardcopy records must first contact Records and Mail Services for advice by calling 1800 359 140 or emailing archives.records@education.vic.gov.au
• When using a contractor or service provider to deliver services, programs or products, schools are strongly encouraged to use DE template contracts to ensure compliance with this policy.
• Hardcopy records must be stored on school premises or with an Approved Public Record Storage Supplier (APROSS).
• The Guidance tab provides further information to support the implementation of this policy and good recordkeeping practices.

Details

Schools are responsible for creating, managing, storing and lawfully disposing of records in accordance with the Public Records Act 1973 (Vic) and standards issued by the Public Record Office Victoria (PROV). This policy and associated guidance pages support schools to comply with these recordkeeping requirements.

Recordkeeping

Schools must systematically and routinely create and keep full and accurate records of school operations and activities, including records relating to:

• finance
• handling of incidents, complaints and investigations
• operations
• personnel management
• school governance
• student management, support, health and wellbeing and teaching and learning.

Records must be retained in accordance with minimum retention periods.

For a list of common school record types and their minimum retention periods, refer to:

• School records retention quick reference guide (DOCX) (staff login required).

For a full list of school record types and their minimum retention periods, refer to:

• School records retention guide (XLSX) (staff login required).

Recordkeeping requirements must be included in local processes and practices where possible and considered when drafting required local policies for school operations (for a good example of this, see the template Attendance policy in the School Policies Templates Portal).

Schools must create and manage new records in digital formats whenever practicable and avoid creating and managing records in hardcopy.

Digital records must be created or captured in authorised departmental systems, such as CASES21 and eduPay. They may also be kept in third-party systems (for example, student management systems) which meet the relevant compliance requirements, such as privacy, information security and child safety.

For further guidance on appropriate systems for creating, storing, and managing digital records, refer to Chapter 5 – Digital recordkeeping.

All records must:

• be given meaningful titles so that they can be easily identified, retrieved and used for authorised purposes throughout their retention period. For further guidance, refer to Chapter 2 – Records naming conventions
• include information about their content and context to ensure they are findable and accessible over time and maintain their authenticity, for example, creation date, modification date, who created the record, and so on. For further guidance on minimum metadata requirements, refer to Chapter 5 – Digital recordkeeping.

Access and control

Schools must have systems and processes for managing access to digital and hardcopy records to ensure the authenticity, security, reliability and accessibility of these records.

Access to records

Records must be organised and stored in a way that makes them easily accessible to authorised staff and enables the timely processing of requests for school information including for subpoenas, inquiries, freedom of information requests, audits, and investigations.

Schools must support openness and transparency, while balancing privacy and information sharing principles. However certain types of records must have restricted access as required by legislation, regulation, and policies including:

• Requests for Information about Students
• Child and Family Violence Information Sharing Schemes
• Privacy and Information Sharing
• Records Management – Employee Information.

For further guidance on restricted records refer to Chapter 3 – Records that must be restricted.

Controls

Access controls must be designed and applied to processes and systems to ensure records are only accessed, amended, used, released or disposed of, as authorised.

For further information, refer to Chapter 5 – Digital recordkeeping, Chapter 4 – Hardcopy records storage and the Information Security – InfoSafe policy.

Right to access, correct or add information to records

Schools must uphold the rights of individuals to access, update and correct records containing their personal or health information, where it is inaccurate, incomplete, out of date, or where it would give a misleading impression.

Schools must also ensure that the information they hold is kept accurate, complete, and up to date.

Schools may make routine or administrative amendments to records when required or requested, for example, when a parent or carer notifies the school of a change in contact details. Schools must make amendments to records to support students affirming their gender, when requested and as reflected in the student’s Gender affirmation student support plan. Such amendments might include updating a student’s first name or pronouns in CASES21. It is good practice to note why the amendment was made on the relevant file or database.

Requests to make a substantive change to a record by adding or removing information, for example, a request to change details of an incident report or a teacher’s observations in a school report, would need to be made formally undersection 39 of the Freedom of Information Act and must be referred to the Freedom of Information (FOI) unit at foi@edumail.vic.gov.au

For further information, refer to the Freedom of Information, Requests for Information about Students, and Privacy policies.

Records storage and preservation

Schools must store all digital and hardcopy records:

• in locations and conditions that protect them from misuse (including unauthorised access, sharing, alteration, destruction or theft), damage, deterioration or loss. This includes when records are being transmitted, transported, migrated, digitised or held on third-party systems
• using formats, methods, locations and services to enable records to survive and remain readable and accessible for their minimum required retention periods
• in systems and storage locations that provide for their efficient retrieval as well as their export and migration or relocation when required
• with an effective maintenance program in place for systems and storage locations to ensure issues are identified and rectified in a timely manner.

For policy and guidance on the maintenance of physical infrastructure, including storage locations, refer to the Buildings and Grounds Maintenance and Compliance policy.

Schools must take precautions, such as use of locked storage areas and strong passwords, to ensure that no records are unlawfully removed from their custody and where this has occurred, they must take appropriate actions to recover them. Appropriate actions include requesting the return of records, if their location is known, and contacting Records and Mail Services at archives.records@education.vic.gov.au to report the loss of records.

When records are stored with third-party providers (for example, cloud or software‐as‐a‐service provider) schools are strongly encouraged to use a DE template contract or service agreement to ensure compliance with this policy.

For further information on this, refer to Chapter 6 – Recordkeeping requirements for third-party systems.

Offsite storage

Hardcopy records must be stored on school premises or with an Approved Public Record Storage Supplier (APROSS). Only temporary retention records can be moved to an APROSS facility, for example, attendance rolls or student files. Permanent records such as pupil registers and school council records must not be stored with an APROSS. Refer to the School record retention guide (XLSX) (staff login required) to identify permanent records.

For information about APROSS facilities refer to the Public Record Office Victoria page: Approved Public Record Office Storage Supplier (APROSS): Information for agencies.

For further guidance, refer to Chapter 4 – Hardcopy records storage.

Schools can contact Records and Mail Services at archives.records@education.vic.gov.au for advice or questions about offsite storage.

Systems and applications

Third-party systems or applications must comply with this policy and guidance.

Systems and applications holding school records must allow for the easy identification, retrieval and use during their retention period.
When using a third-party system or application to create, manage or store records (such as Compass, Xuno, and so on), schools are strongly encouraged to use a DE contract template to ensure compliance with this policy.

The following contract and agreement templates contain recordkeeping clauses that are compliant with this policy:

• School council agreement for the provision of services (DOCX) (staff login required)
• School council short form services contract (DOCX) (staff login required).

Refer to Chapter 6 – Recordkeeping requirements for third-party systems for further information.

The use of School Administration Systems to create and manage records helps schools comply with recordkeeping obligations, and ensure that the privacy, security and integrity of information is suitably protected and maintained. For guidance on mandatory systems of record for school administration processes and information refer to the School Administration Systems policy.

Digitising hardcopy records

Schools wishing to digitise (see definition below) then destroy hardcopy records must contact Records and Mail Services at archives.records@education.vic.gov.au before commencing, for guidance on how to ensure the digitised records comply with recordkeeping requirements set out in Chapter 7 – Digitising hardcopy records.

Records disposal

Schools must routinely and lawfully dispose of records that have met their retention requirements to avoid the over-retention of personal information and to keep record holdings to a minimum.

The School records retention guide (XLSX) (staff login required) outlines how long different types of records need to be kept to assist schools in assessing if records are ready for destruction.

Schools may only destroy records if:

• the records have reached their minimum required retention period and
• the principal has approved the disposal in writing to provide evidence the disposal activity is authorised.

Principals cannot authorise the disposal of:

• any records that are reasonably likely to be required in current or future legal proceedings or a public inquiry, for example, records related to a known risk or incident in the past
• any record that may be required for a current Freedom of Information request
• permanent records or records that are of historic value (for example, Pupils’ Registers, enrolment cards, records created in the 1800s and school anniversary publications). Chapter 1 – Permanent and long-term temporary records contains further details regarding what records cannot be disposed.

Some school information may be destroyed without formal approval once it is no longer required. Refer to Chapter 9 – Normal Administrative Practice for further information.

Schools must securely dispose of digital and hardcopy records in ways that ensure:

• personal, confidential, or sensitive information is protected and cannot be accessed inappropriately
• the records are irretrievable and cannot be reconstructed.

The department recommends the use of secure disposal bins for hardcopy records, for example, locked paper recycle bins.

For further guidance on destroying ‘time-expired’ records in accordance with this policy, refer to Chapter 10 – How to destroy ‘time-expired’ records.

Contracting third-party providers

When using a contractor or service provider to deliver services, programs or products, schools are strongly encouraged to use a DE contract template to ensure compliance with this policy.

For policy and guidance on procurement and template contracts refer to: Schools Procurement policy and Licence and agreement templates.

For guidance on requirements for information technology providers refer to Chapter 6 – Recordkeeping requirements for third-party systems.

Risk management

Records are critical to school operations and must be treated as assets and managed accordingly.

Schools must monitor and manage risks associated with records storage to reduce the likelihood of records loss, damage or misuse. For example, routinely inspect record storage locations and review systems so the issues are identified and resolved.

Use the Hardcopy records storage compliance checklist (DOCX) (staff login required) to assist with identifying and managing risks associated with hardcopy records storage.

For further information, refer to Chapter 4 – Hardcopy records storage and Chapter 5 – Digital recordkeeping.

In the event that records are lost, stolen or damaged, schools must inform the department by contacting the Records and Mail Services on 1800 359 140 or archives.records@education.vic.gov.au. Records and Mail Services can assist with the assessment and remediation of damaged records.

Child safe standards

The Child Safe Standards are compulsory minimum standards for all Victorian schools to ensure they are well prepared to keep children and young people safe and protect them from abuse. To support compliance with the Child Safe Standards, schools must manage their records in accordance with this policy.

For further information, refer to Chapter 11 – Recordkeeping – child safety and wellbeing.

Responsibilities

All school staff are responsible for managing records in accordance with this policy.

All staff are responsible for ensuring school information is kept securely and only shared when authorised to do so.

The Requests for Information about Students Policy provides further advice on when to share information.

All school volunteers

School volunteers must follow the record-keeping requirements set out in their school’s local Volunteers Policy.

Principals

The Secretary is the owner of all Victorian government schools’ records. School principals are the delegated custodians of the records in their school.

Principals have responsibility for:

• school-level compliance with the requirements set out in this policy
• ensuring that all contracts and agreements entered into by the principal or the school council for the procurement of services, programs or products for, or on behalf of, the school identify and specify recordkeeping requirements
• ensuring that records-related risks are identified and managed
• ensuring appropriate recordkeeping practices, including record creation, access and storage, are incorporated into school activities and processes
• authorising disposal of records that have reached their minimum retention requirements and are no longer needed for legal, FOI or administrative purposes
• ensuring that the disposal of records is planned and conducted periodically (for example, annually) and in accordance with this policy
• ensuring that all school staff receive a copy of the Recordkeeping responsibilities for school staff one page guide.

Definitions

Digitisation
The action of converting a hardcopy record into a digital format, for example, by scanning or photographing the record to produce a digital image.

Normal Administrative Practice
Working papers, drafts, duplicate copies of records stored elsewhere, and short-term facilitative records (such as phone messages) may be destroyed without approval once administrative use has ended.

Permanent records
A public record classified as having enduring value to the Victorian community that must be transferred to the State Archives when no longer needed by the school.

Public records
Records in any format or media made or received by staff and volunteers in Victorian government schools.

Temporary records
A public record that is required to be kept for a specific minimum period of time for legislative or other requirements, before it can be destroyed.

Disposal
When schools no longer require records for current business use, they need to decide whether the records should be:

• stored on school premises pending destruction or transfer
• transferred to the state archives
• destroyed.

Collectively all of these actions are known as records ‘disposal’.

Destruction
Destruction is a method of disposal that renders records unreadable and irretrievable.

Related policies

• Child Safe Standards
• Data Collection and Surveys
• Freedom of Information
• eduSTAR – ICT Services, Software and Advice for Schools
• Essential Safety Measures
• ICT Software in Schools – Risk Assessment
• Information Security – InfoSafe
• Privacy and Information Sharing
• Procurement – Schools
• Records Management – Employee Information
• Requests for Information about Students
• School Administration Systems

Relevant legislation

• Accident Compensation (OHS) Act 1996 (Vic)
• Crimes Act 1958 (Vic)
• Child Wellbeing and Safety Act 2005 (Vic)
• Child Wellbeing and Safety (Information Sharing) Regulations 2018 (Vic)
• Education and Training Reform Act 2006 (Vic)
• Equal Opportunity Act 2010 (Vic)
• Evidence Act 2008 (Vic)
• Family Violence Protection Act 2008 (Vic)
• Family Violence Protection (Information Sharing and Risk Management) Regulations 2018 (Vic)
• Financial Management Act 1994 (Vic)
• Freedom of Information Act 1982 (Vic)
• Health Records Act 2001 (Vic)
• Privacy and Data Protection Act 2014 (Vic)
• Public Administration Act 2004 (Vic)
• Public Records Act 1973 (Vic)

Guidance

Good recordkeeping is crucial for the provision of education service to the Victorian community and helps maintain trust with parents and students. It also helps schools meet their obligations under the Public Records Act 1973. All school staff, including service providers, and volunteers share the responsibility for good recordkeeping.

This guidance contains the following chapters:

1. Permanent and long-term temporary records
2. Records naming conventions
3. Records that must be restricted
4. Hardcopy records storage
5. Digital recordkeeping
6. Recordkeeping requirements for third-party systems
7. Digitising hardcopy records
8. Archiving hardcopy records
9. Normal Administrative Practice – records that do not need to be archived
10. How to destroy ‘time-expired’ records
11. Recordkeeping – child safety and wellbeing
12. Records management support for schools

Chapter 1: Permanent and long-term temporary records

Permanent records

These are public records with the highest value to the Victorian community. They provide evidence of significant school activities and decisions and provide a summary of student interactions with the state.

Examples of permanent records include student enrolment records (such as hardcopy pupil registers and enrolment data in CASES21), formal class photos and school council records. Refer to the School records retention guide (XLSX) (staff login required) to identify other types of permanent value records.

Permanent records must not be destroyed or unlawfully removed from school custody.

When permanent records are no longer needed, schools must contact the Records and Mail Services team on 1800 359 140 or archives.records@education.vic.gov.au to arrange the transfer of these records to the State Archives where they will be kept in perpetuity.

Permanent school records

• Summary student enrolment records (hardcopy example: pupils register or enrolment cards; digital example: enrolment data captured in CASES21 database)
• Formal class photographs
• School council meeting documents (for example, minutes, agendas, reports, correspondence tabled at school council meetings)
• School magazines and year books
• School merger committee meeting documents
• School history (for example, histories written for anniversary celebrations)

Historical permanent record types (these are no longer created but your school may still hold them in storage)

• Corporal punishment registers
• Inspector’s report books
• Parents club/‘Mothers’ Club’ meeting papers prior to 1980
• Teacher time books

Long-term temporary records

Long-term temporary records are very important as they provide proof of accountability, transparency of decision-making and administrative processes and can uphold an individual’s rights and entitlements.

These are high value records which must be retained for long periods of time but may be destroyed after the minimum retention period has been met. For example, student health and wellbeing records and visitor logs must be retained for 75 years and school policies must be retained for 20 years.

Refer to the School records retention guide (XLSX) (staff login required) to identify and apply minimum retention periods to records.

Managing permanent and long-term temporary records

Digital records

Schools must ensure:

• long-term sustainable formats are used when creating permanent and long-term temporary digital records
• the minimum metadata requirements outlined on the Digital recordkeeping guidance page are applied.

Hardcopy records

Schools must ensure that:

• permanent records are stored securely onsite and not stored with any commercial storage providers including Approved Public Record Office Storage Suppliers, unless authorised by the department (schools can contact Records and Mail Services on 1800 359 140 or archives.records@education.vic.gov.au at the department to discuss issues with storing permanent records securely onsite)
• new hardcopy records are created using materials that allow these records to survive. For example, avoid using thermal paper (where heat sensitive paper is used to print information, often used for receipts) as these will degrade and fade over time.

Chapter 2: Records naming conventions

Titling records using naming conventions

When naming records, it is essential to use titles that are meaningful to others to ensure records can be identified, retrieved and used for authorised purposes throughout their retention period.

Schools must use naming conventions consistently when titling documents and other records (this includes records that have been digitised). A good record title will include the following elements:

1. Type of document or record, such as ‘minutes’, ‘report’ or ‘template’
2. Subject of the record, such as a team, project or committee name
3. Date, such as ‘2022 March’ or ‘31032022’.

For example: Minutes – School Council – June 2022.

Tips

• Avoid using acronyms. These become out of date over time and make record searches difficult.
• Include information that best describes the record in the title.
• Choose a date format that best suits the nature or frequency with which the record is created. For a file note or weekly report, the full date (day, month, year) would be appropriate. For monthly meeting minutes or an annual report, a partial date (month, year) may be sufficient.

Note: some school administration systems (for example, CASES21) have specific naming conventions that must be used – refer to the relevant user guides.

Chapter 3: Records that must be restricted

Schools must support openness and transparency by ensuring staff have access to the records they need to perform their duties, and only restricting records to meet legislative requirements, regulations, or policies, such as privacy laws.

Access to records that contain personal, sensitive, health or confidential information must be restricted, and only shared with staff on a ‘need to know’ basis. This helps to protect personal information from misuse, loss and unauthorised access, modification, disclosure, or any harm that may arise.

For example:

• student health and wellbeing records must be restricted, and access controlled because they contain students’ health/personal information. Records containing health information require a higher level of protection – refer to the health information guidance page
• personnel records must be restricted, and access controlled because they contain personal, sensitive, health or confidential information about staff.

Schools must annually review:

• users of school administration systems and ensure that only authorised users have access, as per the End of all terms checklist (staff login required)
• open-access folders in systems and sites (including the school’s website) for any records with personal or sensitive information and remove them immediately. Open access folders are folders without any access controls, and such folders must not be used to store personal or sensitive information.

If schools find personal or sensitive information exposed in open-access folders, they must immediately secure it and then advise the Privacy Team at privacy@education.vic.gov.au as such instances may constitute a breach and so must be assessed for privacy risk and risk of harm. The Privacy Team will assist with this and any other remediation actions in accordance with relevant policy and legislation.

The following policies provide further supporting information to inform decisions about access to information and records:

• Child and Family Violence Information Sharing Schemes
• Child Link
• Freedom of Information
• Information Security – InfoSafe
• Privacy and Information Sharing
• Requests for Information about Students

Chapter 4: Hardcopy records storage

Schools are responsible for protecting records in their custody from misuse, loss, deterioration, and damage. This guidance page outlines what schools must do to ensure records storage areas and facilities are protected.

Store hardcopy records in a suitable and secure location

• Hardcopy records storage areas and facilities must be secure so that only authorised staff can access records, for example, a lockable room.
• If possible, use a dedicated storage area or facility to store records to:
  • avoid damage or contamination to records (for example, storing records in the same location as chemicals, including cleaning products or petrol, increases the risk of contamination)
  • make it easier to restrict access to authorised staff (for example, if furniture and stationery are stored in the area, unauthorised individuals will require regular access).
• Avoid storing records in attics, basements, and shipping containers, unless measures have been taken to mitigate risks of damage to records. For example, if records are stored in a basement, it should be waterproof, well-ventilated to prevent mould, and with shelving raised off the floor by 100 to 150 mm to prevent damage to records in the event of a flood.
• Use the Hardcopy records storage checklist (DOCX) (available in the resources tab) to check if storage areas or facilities meet compliance requirements.
• Complete PART A of the Hardcopy records storage checklist before designating an area or facility for hardcopy records storage.
• Follow the Manual Handling policy and consider manual handling risks when storing records.
• Use sturdy boxes with lids to store records. This helps reduce manual handling risks, helps safeguard records and allows records to be relocated efficiently.
• Hardcopy records must be stored in an organised manner (for example, sorted by alphabetical order and function), to ensure that they can be easily retrieved when required.

Regularly inspect and maintain records storage locations

Schools must regularly inspect and maintain hardcopy record storage locations to ensure the long-term preservation, safety, and security of records.

Schools can use PART B of the Hardcopy records storage checklist (DOCX) (staff login required) to inspect storage locations and identify maintenance issues.

Conduct inspections at least annually, and rectify any identified maintenance issues as soon as possible.

The Buildings and Grounds Maintenance and Compliance policy and the Essential Safety Measures guidance outline the minimum inspection and maintenance requirements for school facilities, which include hardcopy records storage areas and facilities.

Maintenance issues that can potentially affect the preservation and safety of hardcopy records should be raised with the Victorian School Building Authority Rolling Facilities Evaluation team and included and prioritised in the 5-year School Maintenance Plan or included in the Planned Maintenance Program.

Movement of hardcopy records

Schools must maintain sufficient information about the content and location of hardcopy records.

If hardcopy records need to be relocated to another storage area within school premises, to another school or an Approved Public Record Office Storage Supplier (APROSS), there is a risk of losing records in the process.

Schools must track the movement of records accurately to ensure their current location is always recorded. A spreadsheet or a simple list can be used, with details such as:

• a brief description of the records that are to be moved
• the new location
• date of transfer
• reason for relocation, for example, student transfer.

It is good practice to check that the prepared records correspond to the spreadsheet or list before and after transfer, for example, by seeking confirmation from the receiving school.

If staff are responsible for moving physical hardcopy records, they must also follow the Manual Handling policy to identify and address manual handling risks.

Chapter 5: Digital recordkeeping

Digital recordkeeping is the practice of creating, managing, storing, and preserving records and documents in digital formats. Digital recordkeeping leverages electronic systems and technologies to capture, organise, and maintain records throughout their lifecycle.

Digital records include those created in a digital format (born digital) and those converted into a digital format (for example, scanned documents).

Creating and managing digital records

1. Digital first: Create and manage new records digitally whenever possible and reduce the creation and use of paper records.
2. Use authorised and compliant systems: Keep digital records in school administration systems and compliant third-party systems. Do not store any personal or sensitive information on the curriculum drive.
3. Metadata: Capture and maintain metadata alongside each digital record to describe its context and content. Refer to the section below ‘Minimum metadata requirements’ for more information.
4. Access controls: Implement and regularly update access controls to protect digital records from unauthorised access, alteration, or theft. At the end of every term, check that authorised users of school administration systems are current and that any users who have left the school or changed roles during the previous term can no longer access systems used at your school, as per the end-of-term checklist. School administrators can assist with this at the direction of school principals.
5. Naming conventions: Follow naming conventions when creating digital records to ensure consistency and make records easy to locate.
6. Third-Party systems: If using third-party systems to create or store digital records, ensure they meet the minimum metadata requirements detailed below and other recordkeeping requirements.
7. Procedures and processes: Include recordkeeping requirements in documented procedures and processes to ensure digital records are routinely created and captured in school systems.
8. Relationships between records: Create relationships between digital records to establish a business context where appropriate. Refer to this CASES21 Administration User Guide and other relevant user guides for further information on this.
9. Long-term sustainable formats: Use long-term sustainable formats for permanent and long-term temporary records – refer to further guidance below.

Minimum metadata requirements

Metadata is essential data that describes the context, content and format of records which enables their management through time. A document title is one type of recordkeeping metadata.

Metadata helps others find records. Metadata tells people who created the record and when. Metadata can also capture what the record is about, how sensitive the information it contains is, and how long it must be kept.

Capture and maintain the following metadata for all records:

• Identifier: This can be a document title and/or a system-generated number that helps identify a specific record, for example, student and family ID is automatically generated by CASES21 at the time of creating a new record.
• Author and/or editor: Information about the individual, for example, a role, program area or system that acted on a record, for example by creating or modifying it.
• Date/s: All relevant date/s of actions affecting the record, for example, creation date, modification date, date of transfer to another school.

Note: some school administration systems automatically capture metadata or help you capture metadata when creating records with the use of mandatory fields. Systems such as SharePoint, Microsoft office, CASES21 may generate this metadata automatically.

Additional metadata for permanent and long-term records

For permanent or long-term temporary records, capture the following additional metadata:

• Disposal: Information about the retention period and disposal actions that relate to a record, including whether the record is permanent.
• Description: Further information about a record and/or its context. Examples of descriptions may include a title if the identifier is numeric, or an extended description of the record.
• Format: A description of the record’s format, such as a text-based document, image file or data table.

Long-term sustainable formats

Permanent and long-term temporary records must be kept in long-term sustainable formats. Long-term sustainable formats allow digital records to survive and remain accessible and readable using readily available software for the required life of the record.

Long-term sustainable formats include:

• Portable Document Format (.pdf) (do not use PDF/A-3)
• Microsoft Word (.doc, docx)
• Plain text (.txt)
• Microsoft Excel (.xls, .xlsx)
• Comma separated values (.csv)
• Microsoft PowerPoint (.ppt, .pptx)
• Microsoft Outlook (.msg or .pst)
• Joint Photographic Experts Group (.jpg, jpeg)
• JPEG2000 (.jp2)
• Tagged image file format (.tif, .tiff)
• Portable Networks Graphic (.png)

Tip: If using scanners to create digital records, configure them so that scanned records meet long-term sustainable formats (see below), some metadata is automatically captured, and the images are captured into the relevant system.

Backup and archiving

Records created or stored in third-party systems or temporary storage locations (such as the school’s P drive), that require long-term retention, should be backed up regularly. Inactive records that do not need to be accessed regularly should be archived.

Backup

It is recommended to backup data stored on staff and student devices by configuring cloud-based data storage services on these devices. The department-approved cloud-based data storage services for use by schools are:

• Google Drive
• Microsoft OneDrive

For further guidance on backing up records to your school’s U drive refer to ICT Infrastructure Backup and Recovery – Schools.

For further information on backing up CASES data stored in the temporary P: drive refer to the CASES21 Administration User Guide – Chapter 1, Introduction (PDF) (staff login required).

Archiving

When archiving digital records, school staff must ensure the records are:

• saved in a format that will mean they can be accessed easily, such as in a long-term sustainable format
• stored in a secure location that is well maintained and backed up regularly, such as the U: drive or a department provisioned SharePoint site.

Further information

For any further queries contact the Records and Mail Services team at archives.records@education.vic.gov.au

Chapter 6: Recordkeeping requirements for third-party systems

Schools are responsible for ensuring that third-party systems comply with all the recordkeeping requirements outlined in the School Records Management policy and this guidance.

This guidance aims to create awareness around the recordkeeping requirements that apply to third-party systems that create, manage or hold school records.

Any school system that is not provisioned by the department is considered a 'third-party' system. Refer to the School Administration Systems policy and to Arc to identify which systems are provisioned by the department, and systems which have undergone security and privacy assessments.

When using a third-party system or application to create, manage or store records (such as Compass, Xuno, and so on), schools are strongly encouraged to use a DE contract template to ensure the provider will meet the requirements outlined below.

This guidance page must be read in conjunction with the Procurement – Schools policy and the Information Security – InfoSafe policy.

System requirements

System security and privacy

For policy and guidance on what schools must do to ensure the security of new systems and the suppliers who provide them, refer to:

• ICT Software in Schools – Risk Assessment policy
• Information Security – InfoSafe policy.

For policy and guidance on what schools must do to ensure new systems manage privacy appropriately refer to: Privacy and Information Sharing policy.

Retention and disposal

The supplier must:

• ensure the system can retain records for the minimum retention periods outlined in the School records retention guide (XLSX) (staff login required)
• only destroy (delete) ‘time-expired’ records (records that have served their minimum retention period) when no longer required with the written approval of the school principal
• ensure the system can facilitate compliant retention and disposal of records and their metadata or be able to export these records to another system which can manage retention and disposal.

System maintenance

Suppliers must:

• regularly audit and review systems (including software, servers, and networks) for their suitability in meeting recordkeeping needs and obligations, that is, functionalities are working as expected
• routinely maintain systems to ensure that they are reliable, operate effectively and do not place records at risk. This involves monitoring performance to ensure that any system changes do not inadvertently impact recordkeeping controls
• perform regular preventative maintenance, such as application of patches to ensure systems function reliably. Corrective actions must be implemented if issues arise.

Examples of functionality checks:

• access restrictions are working as expected
• correct metadata is being captured and auto-populated where possible
• workflow is functioning as expected
• records are held in the correct formats
• unauthorised activities are being prevented (that is, deletions, alterations)
• audit logs are being correctly generated and stored
• records remain discoverable and readable over time (that is, can be found through searching and are not corrupted).

Additional monitoring may be required during times when changes are occurring, such as administrative changes, system upgrades or data migrations.

Examples of maintenance activities:

• ensuring that product versions and security patches are kept up to date
• checking that system functionality is working correctly and reliably
• testing backup arrangements, to check that records and associated metadata remain accessible and uncorrupted
• checking that any system technologies or storage devices (servers, tapes and so on) are held in appropriate environmental conditions, checked for degradation, and replaced/rotated as necessary.

System transition

Transitioning a system can place records at risk of loss or corruption. Examples of transitions are:

• upgrading a system
• replacing a system – which involves migrating some or all of the data/records and associated metadata to the replacement system and decommissioning the old system
• changing service or hosting arrangements – for example changing service providers or moving from an in-house hosting arrangement to an externally hosted cloud-based arrangement.

When systems undergo transition, third-party providers must ensure that:

• records and their metadata are protected (continue to be complete so that records retain their context)
• records remain accessible and usable for their minimum required retention period
• if a transition involves migration of records, checks are performed to ensure both records and metadata have been migrated successfully
• permanent value records are identified and protected.

Decommissioning and end of agreement

When third-party systems are decommissioned or when agreements with suppliers end, schools must ensure that:

• ‘time-expired’ records are destroyed by the supplier
• records that have not yet reached their minimum retention period are transferred to the schools’ custody, in long-term sustainable formats, along with their associated metadata
• the supplier does not retain any copies of school records and data once records have been successfully migrated to their new location.

The Records and Mail Services team can be contacted on 1800 359 140 or at archives.records@education.vic.gov.au for further information or advice.

System planning and procurement for recordkeeping

Step-by-step

Follow the steps outlined below along with the Schools procurement procedure (PDF) (staff login required) when procuring business systems that will create, manage, or hold records.

Step one – planning

Identify the recordkeeping needs and obligations that the system must be able to support.

• 1.1 Define the process, function, or activity that the system is being procured to facilitate and determine recordkeeping needs.

• 1.2 Identify the record types and associated retention periods that will be managed in the system.

  The School records retention guide (XLSX) (staff login required) outlines the minimum retention periods for school records types.

• 1.3 Identify the recordkeeping and information handling obligations associated with that process.

  For example:

  • Will the system hold personal or sensitive information that must be kept secure with controlled access to certain people?
  • Will the system need to be able to store large files or a lot of data? Large scanned documents, digital images or video files can take up a lot of storage space and will often require the purchase of additional digital storage.
  • Will the system hold data that needs to be retained long-term?
  • Will the system be used to collect information needed only for short term administrative purposes, that does not need to be retained, such as personal information collected for identity verification only, or credit card payment details that must be immediately and permanently deleted after use?

Step two – system and supplier selection

• 2.1 When choosing a system, check the required capability to meet the identified recordkeeping needs and obligations, including:

  • role-based access controls
  • secure and sufficient digital storage
  • deletion controls (including prevention or authorisation of deletion; permanent/irrevocable deletion where appropriate, based on your identified information handling obligations)
  • storage and/or migration of inactive records in long-term sustainable formats, such as .PDF or .CSV
  • back-up and recovery regimes.

  This step will also help you identify and address actions that are required for security and privacy compliance.

• 2.2 If the third-party system will be used to collect and store personal and/or sensitive information schools may need to complete a Privacy Impact Assessment.
• 2.3 Follow the ICT Software in Schools – Risk Assessment and Information Security – InfoSafe policies to ensure all new systems meet information security and ICT security requirements.
• 2.4 Document these requirements in an agreement between the school and the supplier to ensure recordkeeping obligations are met in the third-party system by using the departmental contract and agreement templates which contain standard recordkeeping clauses:
  • School Council agreement for the provision of services (DOCX) (staff login required)
  • School Council short form services contract (DOCX) (staff login required)

Step three – set up and implementation

• 3.1 Ensure that the requirements and system functionalities identified in step 1 and 2 are set up in the selected system. School technicians may be able to assist schools with this.
• 3.2 School technicians must monitor system performance and set-up from time to time to ensure that the supplier is meeting the recordkeeping requirements set out in the service agreement, such as access controls, system maintenance and security patches.

Chapter 7: Digitising hardcopy records

Follow this guidance chapter to understand digitisation requirements.

Planning for digitisation

Before starting to digitise hardcopy records, consider the following:

• Is the effort or cost worth it? Digitising hardcopy records can be a labour-intensive and time-consuming job. It can also be costly to use a commercial provider. It may not be worth digitising records that only need to be kept for a short period of time or that are unlikely to be accessed often.
• What are the risks of compromising the record? Some records are critical because they contain highly sensitive and important information, for example, student health and wellbeing records. The digital copy must be high quality so it can be relied on as the authoritative record when the hardcopy is destroyed. It’s important to factor in time for quality assurance checks as poor scanning processes can result in unusable or unreliable records.
• Where will the digital records be stored? The records must be kept in an authorised location or system that will protect the record, from unauthorised access, alteration or deletion.

Permanent and historic records

The Public Record Office Victoria has mandatory technical and quality assurance requirements for digitising permanent value records (records that are eventually transferred to the state archives), for example, school council meeting papers.

Some historic and permanent hardcopy records including all those created before 1 January 2000 must not be disposed of after digitisation. This includes pupil registers, corporal punishment registers, inspector’s report books, parents’ clubs/ mothers’ club meeting papers prior to 1980 and teacher time books.

Refer to the School records retention guide (XLSX) (staff login required) to identify other types of permanent value records.

Schools considering digitising permanent value records must contact Records and Mail Services for advice.

Temporary retention records

Before digitising temporary retention records, schools are advised to develop a Digitisation Activity Plan which will support the creation of reliable digital records.

Hardcopy records can only be destroyed after they have been digitised, if the digital records are of sufficient quality to become the school’s official record.

Further information

Contact Records and Mail Services at archives.records@education.vic.gov.au

Chapter 8: Archiving hardcopy records

The following steps will help schools to archive hardcopy records efficiently and effectively.

Step 1 – Sort records

Sort records by type. For example

• put all finance records together in one box
• put all school excursion permission slips together in a different box.

This will make it easier to find and dispose of the records.

To help sort common school records by type, refer to:

• School records retention quick reference guide (staff login required)

Ideally this will be referenced as a digital copy to maintain currency, however, if printed, be sure to use the latest version as the content may be updated from time to time.

Step 2 – Arrange records in boxes

Arrange the records in their box in an order appropriate to each record type. For example:

• arrange finance records by financial year in date order
• arrange student files by year of exit then alphabetically by surname
• arrange parent permission forms for camps and excursions together with other documents related to that event by year
• arrange personnel files by year of exit then alphabetically by surname
• arrange school council meeting papers by month and year.

Step 3 – Label and list boxes

Label the boxes with the record type and relevant year, for example, ‘Finance – batch reports – 2018-19’, or ‘Student files – exit 2019’.

Make a list of your archived boxes, capturing the same information you recorded on the box labels. Keeping a list of your records will help you find records easily when needed. Keep the list with other documents relating to the management of the school’s records, for example, a ‘School Records’ digital folder or location.

Archiving tips

• Regularly archive records, at least once a year.
• Only archive inactive records, that is, records you no longer need ready access to.
• Only archive single copies of documents – duplicates may be disposed without formal approval under ‘Normal Administrative Practice’.
• Remove records from binders, clips and plastic sleeves where possible – these take up extra space in archive boxes and make later disposal more time consuming.
• Use paper or manila folders to separate records where necessary.
• Use good quality archive boxes made of sturdy cardboard that include a double layer of cardboard on the bottom to prevent collapse. Use half-size, archive boxes to prevent boxes becoming too heavy.
• Do not over fill boxes. This can make them unsafe to lift and cause damage to boxes.

For a list of common school record types that must be archived, refer to:

• School records retention quick reference guide (DOCX) (staff login required)

For a full list of school record types that must be archived, refer to:

• School records retention guide (XLSX) (staff login required)

Chapter 9: Normal administrative practice – records that do not need to be archived

Some information can be routinely destroyed following a process known as Normal Administrative Practice.

Normal Administrative Practice allows the routine disposal of information that is not an official school record, examples include:

• working documents consisting of rough notes and calculations used only to assist in the preparation of other records such as correspondence and reports – for example, handwritten attendance rolls subsequently captured in CASES21
• records of short term or temporary value – for example, a reminder note or list of things to do
• additional copies of documents, emails and publications maintained for reference purposes – for example, duplicate copies of School Council papers.
  

Refer to Chapter 10 – How to destroy ‘time-expired’ records for guidance on how to formally dispose of official school records.

Chapter 10: How to destroy ‘time-expired’ records

'Time-expired’ records are records that have passed the minimum retention period, as per the School records retention guide (XLSX) (staff login required). Time expired records may be lawfully destroyed.

Principals must ensure the regular disposal of time-expired records that are no longer needed for operational purposes. Routine record disposal:

• keeps the volume of personal information in the school’s custody to a minimum
• reduces the burden and costs associated with managing large collections of records
• makes searching for relevant information more efficient.

Schools must ensure that third-party providers do not destroy hardcopy or digital records, unless explicitly and appropriately authorised to do so. For further information on this, refer to Chapter 6 – Recordkeeping requirements for third-party systems.

Schools must ensure that all personal, confidential, and sensitive information is protected and cannot be accessed inappropriately during the destruction/deletion process.

Schools must not destroy records that are reasonably likely to be needed for current or future legal proceedings, including any civil or criminal proceeding or any inquiry such as a Royal Commission or Board of Inquiry, even if their minimum retention period has passed, for example, records related to a known risk or disclosure of an incident such as allegations of child sexual abuse.

How to destroy records

School staff must follow the below procedure before destroying any records.

Note: School principals must approve the destruction of time-expired records.

If a school is going through a merger or closure and does not have a principal to approve the destruction of time-expired records, contact the Records and Mail Services team at archives.records@education.vic.gov.au for authorisation.

Step 1 – Identify ‘time-expired’ records

Records become ‘time-expired’ if they have passed the minimum retention period and are no longer required by the school and are not reasonably likely to be needed for current or future legal proceedings. For example, the minimum retention period for finance batch reports is 7 years. Batch reports from the 2012-2013 financial year ‘expired’ in July 2020. If the school no longer needs them, the principal must approve their destruction and they must be securely destroyed.

For a list of common school record types and their minimum retention periods, refer to the School records retention quick reference guide (DOCX) (staff login required).

For a full list of school record types and their minimum retention periods, refer to the School records retention guide (XLSX) (staff login required).

Step 2 – Prepare records for destruction

Create a list of records for destruction. The list should include a brief description of the records proposed for destruction, their current location and format, and the record classification.

For a full list of school record types, their minimum retention periods and record classification, refer to the School records retention guide (XLSX) (staff login required).

Step 3 – Principal approval to destroy records

School staff or volunteers must then provide the list of records for destruction to the school’s principal and obtain their approval to destroy the records. For a pro-forma email to send to principal, refer to the Records destruction pro-forma email (DOCX) (staff login required).

The principal’s approval to destroy the records, must be documented, saved and stored with other documents relating to the management of the school’s records, for example, create a ‘School Records’ digital folder or location.

Step 4 – Destroy records

Ensure hardcopy records are securely destroyed, for example by placing them in a secure (locked) recycling bin that has been supplied by a provider that will ensure records are shredded or pulped and cannot be reconstructed, or by destroying the records locally using a shredding machine, ensuring that they cannot be reconstructed.

For digital records – 'hard delete’ from recordkeeping systems and from other locations such as digital ‘recycling bins’, backups, servers, preservation libraries, storage devices or disaster recovery environments.

Step 5 – Keep evidence of records disposal

Keep a list of all the records being destroyed, including the date the destruction took place. This should be saved with other documents relating to the management of the school’s records, for example, in the same folder or location as the records listing/s.

Chapter 11: Recordkeeping – child safety and wellbeing

Recordkeeping and the Child Safe Standards

The Child Safe Standards are compulsory minimum standards to ensure organisations that provide services to children are well prepared to keep children and young people safe from harm and abuse. Ministerial Order 1359 – Implementing the Child Safe Standards – Managing the risk of child abuse in schools (PDF) outlines how the Child Safe Standards apply in Victorian schools.

Schools must understand and follow their recordkeeping obligations under this policy to comply with Child Safe Standards. Child Safe Standard 2 (Ensure that child safety and wellbeing are embedded in school leadership, governance and culture), which requires schools to create, maintain and dispose of records relevant to child safety and wellbeing in accordance with Public Record Office Victoria Standards.

Schools must:

• maintain records relevant to child safety and wellbeing and keep them organised in a way that ensures they are searchable and retrievable
• store child safety and wellbeing records securely, protected from unauthorised access
• retain student safety and wellbeing records for a minimum of 75 years
• retain all records documenting the reporting and investigation of sexual abuse incidents, allegations and disclosures for a minimum of 99 years
• retain screening records for school staff applicants, such as working with children checks as per the School records retention guide.

Refer to the School records retention guide (XLSX) (staff login required) for the retention requirements of all student safety and well-being records.

For more information, visit:

• Child Safe Standards
• PROTECT

Chapter 12: Records management support for schools

Advice and services

The department’s Records and Mail Services unit provides records management advice and services to schools including:

• advice on how to apply the Records Management policy, guidance and resources in your school
• remediation of damaged records
• managing records from closed and merged schools, including transferring records to off-site storage
• transferring permanent school records to the State Archives.

Schools Records Management Program

The Schools Records Management Program supports schools to better manage their records.

Schools that participate in the program receive:

• assistance and on-site advice from specialist archivists
• collection, digitisation and transfer of permanent records to the State Archives (schools receive a copy of some of the digitised permanent records)
• support to dispose of time-expired records.

Contact Records and Mail Services at archives.records@education.vic.gov.au for information on participating in the program.

Further information

Contact the Records and Digitisation Services team on 1800 359 140 or at archives.records@education.vic.gov.au

Resources

School records retention guide

School records retention guide (XLSX) (staff login required) – Refer to this guide to understand how long specific records need to be retained and identify records that have passed the required retention period and can be legally disposed of. This guide covers all retention requirements schools need to know, based on the various retention and disposal authorities issued by the Public Record Office Victoria.

Note: This guide is updated regularly. Schools should use the links provided in this policy to access the most current version.

Hardcopy records storage checklist

Hardcopy records storage checklist (DOCX) (staff login required) – Use PART A of this checklist to ensure that new and existing hardcopy records areas or facilities are compliant and PART B to inspect and maintain hardcopy records storage areas or facilities to ensure they remain compliant.

School records destruction approval email template

School records destruction approval email template (DOCX) (staff login required) – Use this email template to seek the school principal’s approval to destroy ‘time-expired’ records that are no longer needed by your school.

Recordkeeping responsibilities for school staff

Recordkeeping responsibilities for school staff (DOCX) (staff login required)