Most advice about data retention is about deleting things. The Ofqual penalty against the Associated Board of the Royal Schools of Music (ABRSM), announced on 14 October 2026, is a reminder that the opposite failure can be just as costly.
First, what this is and is not. It is an enforcement action by Ofqual, the qualifications regulator. It is not an ICO action and it is not a UK GDPR fine, and no personal data breach is alleged. We cover it because the failings are ones every organisation holding records about people can recognise, and because they map closely onto principles the UK GDPR already asks you to follow.
What Ofqual found
Ofqual fined ABRSM £150,000, and ABRSM agreed to contribute £10,000 towards Ofqual's costs, after failures to retain and manage assessment evidence. Three separate incidents between 2024 and 2025 were set out:
- A software error meant 8,539 audio recordings of completed assessments were not retained. Twenty learners who asked for a marking review could not have one with all the original evidence available.
- Recordings and marking records for 16 learners were deleted in error. This delayed results and limited those learners' ability to challenge their marks.
- ABRSM flagged possible malpractice by one overseas tutor who had entered 710 learners. Because 231 recordings were unavailable, the investigation could not be as complete as it should have been.
Separately, about 72,000 certificates carried incorrect qualification titles. ABRSM later corrected the error, told learners and offered replacements, but Ofqual found it did not at first take all reasonable steps to put things right. ABRSM must also commission an independent audit of its assessment record-retention arrangements.
Amanda Swann, Ofqual's Executive Director for Delivery, said: "Awarding organisations have a responsibility to retain assessment evidence and ensure it is available when needed."
Why this is relevant to data protection
Four UK GDPR ideas are in play. Accuracy (Article 5(1)(d)) requires personal data to be accurate and kept up to date, and a certificate with the wrong title is an accuracy problem in the plainest sense. Storage limitation (Article 5(1)(e)) requires data to be kept no longer than necessary, which also implies it should be kept as long as it is needed to do what you said you would do with it. Individual rights include access and rectification, and you can only honour them if the records exist and are right. And accountability (Article 5(2)) means you must be able to demonstrate compliance, which is hard without records.
Retention is a promise, not just a deadline
Many organisations set retention periods as a maximum: delete after six years. Fewer set them as a minimum with a purpose: keep for at least twelve months because learners can ask for a review, or for at least six years because that is the limitation period for a contract claim. Both halves matter, and both need an owner.
This applies well beyond exam boards. Schools hold pupil files and safeguarding records. Training providers hold assessment evidence. Charities hold consent records and safeguarding notes. Employers hold disciplinary records that may be needed at a tribunal. In every case, deleting too early is a risk and so is keeping too long.
Where retention goes wrong in practice
Most failures follow one of four patterns:
- System changes. A migration, upgrade or new supplier drops a data set that should have been kept, or carries over one that should have been deleted.
- Automation without review. A deletion rule is set once and nobody checks it still matches the policy.
- No owner. Everyone assumes IT or administration looks after it.
- Error handling. When something goes wrong, there is no clear process for deciding who is affected, what to tell them and how to record what was done.
The ABRSM findings include at least three of these: a software error, an accidental deletion and a slow response to a widespread error.
A worked example
A training provider moves to a new learning platform. The old system kept learner work for seven years, because an awarding body can ask to see it. The new platform's default is to purge files after two years. Nobody notices until a learner appeals a result in year three. A one-page retention schedule, listing record type, purpose, minimum and maximum period, owner and deletion method, would have caught it before the migration. (This is an invented example, not based on any real organisation.)
Five questions to ask about your own records
- For each major record set, what is the purpose, the minimum and maximum retention period, and who decided?
- When systems change or are upgraded, who checks that nothing that should be kept is dropped, and that nothing that should be deleted is carried over?
- Is deletion automated, and if so, who reviews the rules and tests them?
- If someone challenges a decision, such as a mark, a refusal or a complaint outcome, could you produce the evidence you relied on?
- When an error affects many people, such as wrong titles on certificates, who decides how to fix it, tell people and record what you did?
Where to start
Pick your three most sensitive record sets, such as pupil files, client files or membership records. For each, write one line on purpose, retention, owner and how it is deleted. That is the seed of a proper retention schedule and a Record of Processing Activities. It can be done in an afternoon, and it will be useful the next time something goes wrong.
Frequently asked questions
Does UK GDPR require a retention schedule? It does not use that term, but you must be able to justify how long you keep personal data, and a schedule is the usual way to do so.
Can I keep records "just in case"? Not indefinitely. You need a stated purpose and a reasonable period, and the more sensitive the data, the stronger the justification must be.
What if I find an error affecting many people? Fix the record, tell those affected in plain language where it matters to them, and keep a written note of what you decided and why.
Is deleting a record by mistake a data breach? Accidental loss or destruction of personal data can be a personal data breach under UK GDPR. Assess it and record the outcome, even if you decide it need not be reported.
How Pathway 2 Privacy can help: a RoPA gives you the written map regulators ask for, a Data Governance Framework assigns owners and reviews to each retention rule, and a Policy Review checks that your retention and rectification policies match what your systems really do. See our data protection support for schools and education, or start with a free data protection review.
