A teacher deletes a student file from a laptop. Is the information gone?
Not necessarily.
Deleting a file doesn’t always mean the underlying data has been securely destroyed. Depending on the device and how the data was deleted, information may remain recoverable even after a file has been deleted or a device has been reformatted.
For schools, school districts, colleges, and universities, that distinction matters. Educational institutions manage enormous amounts of sensitive information every day—from student records and health information to financial records, employee files, testing materials, and administrative documents.
And that information doesn’t simply disappear when a school year ends, a student graduates, or a computer is replaced.
Secure data destruction is the final step in the information lifecycle. Just as schools take care to collect, store, and protect sensitive information, they also need a plan for determining when records can be destroyed—and how they should be destroyed when that time comes.
Schools Have More Sensitive Data Than You Might Think
Think about everything a school handles during a single academic year. Student records. Grades and attendance information. Health and medical information. Special education records. Testing materials and student responses. Discipline records. Financial information. Employee files. Parent and guardian information. Permission forms. Administrative documents.
Much of this information contains personally identifiable or otherwise sensitive information that shouldn’t simply be placed in a trash or recycling bin when it is no longer needed.
Virginia’s current public-school records retention schedule illustrates just how much information schools are responsible for managing. The Library of Virginia’s General Schedule GS-21 includes dozens of public-school record series, ranging from student attendance and grade records to health information, special education records, testing materials, disciplinary records, and student cumulative files.
And those records don’t all have the same retention requirements.
Before You Destroy Anything, Know the Retention Requirement
One of the biggest mistakes an organization can make with records management is assuming that something can be destroyed simply because it is old, outdated, or no longer useful to the person who created it.
The Library of Virginia’s General Schedule GS-21: Public School, effective June 11, 2026, identifies specific retention periods and disposition methods for public-school records. Some records may be eligible for destruction after the end of an academic year, while others must be retained for several years—or much longer.
The retention periods can be surprisingly different. For example, the current schedule calls for:
- Student Attendance Records: 5 years after the end of the academic year
- Grade Records: Report Cards: 1 year after the end of the academic year
- Athletic Physical Examination Records: 5 years after the end of the academic year
- Student Cumulative File: Long-Term Documentation: 75 years after the student graduates, completes the Board of Education program, transfers, or withdraws
- Student Accident/Injury Reports: 23 years after birth
That’s a pretty wide range—from the end of an academic year to 75 years.
The takeaway is simple: schools shouldn’t treat every old record the same way. Before destroying a record, they need to determine whether its retention period has expired and what the applicable schedule requires when it does.
A New School Year Is a Good Time to Review Records
The start of a new school year isn’t just a time to prepare classrooms, technology, and staff for what’s ahead. It’s also a natural checkpoint for reviewing records from the previous academic year.
Virginia Department of Education guidance on records management encourages public schools to organize records and distinguish between active and inactive records while following applicable retention schedules and disposition requirements.
For many school records, the retention period is tied to the end of the academic year. That makes the transition between school years a practical time for schools to review what they have, identify records that may have reached the end of their retention period, and prepare eligible records for appropriate disposition.
But “end of the school year” doesn’t mean “destroy everything from last year.” Each record series has its own retention period and disposition requirements, so schools should review the applicable schedule before anything is destroyed.
Not Every Record Is Destroyed the Same Way
There’s another important detail in Virginia’s public-school records schedule: not every record is designated for the same type of destruction. GS-21 distinguishes between confidential destruction and non-confidential destruction.
Records designated for confidential destruction include many types of information that could contain sensitive student or personal information. Examples include student attendance records, grade records, health information, special education records, testing materials, student disciplinary records, and student cumulative files.
Other records are designated for non-confidential destruction. These include certain academic progress records, accreditation records, curriculum and program development records, some reports and studies, teacher classroom records, and other administrative materials.
The distinction is important because “destroy” doesn’t necessarily mean the same thing for every record. Schools need to follow the applicable disposition method for the specific record series rather than treating every outdated document as if it has the same requirements.
Virginia’s Public Records Act Adds Another Layer
For Virginia public schools and school divisions, records retention and destruction also fall within the framework of the Virginia Public Records Act (VPRA). Under Virginia Code § 42.1-86.1, a public agency generally cannot destroy or discard a public record simply because its retention period appears to have ended. The record must appear on an approved retention and disposition schedule, and its retention period must have expired.
A Certificate of Records Destruction must also be properly completed and approved by the agency’s designated records officer. In addition, there cannot be a pending litigation matter, audit, investigation, FOIA request, or renegotiation of the applicable retention schedule at the expiration of the retention period. After destruction, the original Certificate of Records Destruction must be forwarded to the Library of Virginia.
In other words, the end of a retention period is not necessarily a green light to immediately throw a record away.
There is a process.
For public agencies, that process helps ensure that records are not destroyed prematurely and that their disposition is properly documented.
What About Records Containing Sensitive Information?
Virginia also has specific requirements for the destruction of public records containing Social Security numbers once their retention periods have expired.
Under Virginia’s regulations governing the destruction of public records containing Social Security numbers, paper records must be shredded, pulped, or incinerated. When shredding is performed off-site by a contractor, locked bins are required to protect the records before destruction, and the agency remains responsible for protecting the Social Security numbers until destruction occurs.
The requirements also extend to electronic records.
For example, Virginia’s regulations state that files containing Social Security numbers stored on a computer cannot simply be deleted. They must be overwritten using software designed to obliterate the original data and prevent it from being reconstructed. The regulations also address backup tapes, other magnetic storage media, CD-ROMs, and computers containing Social Security numbers.
That’s an important distinction. Deleting a file and securely destroying the information contained in that file are not necessarily the same thing.
Paper Isn’t the Only Problem
Today, a school’s sensitive information can exist in many different forms.
A file cabinet may contain paper student records. A teacher’s computer may contain years of electronic documents. An outdated laptop may still contain locally stored files. A retired hard drive may contain information that was deleted years ago. USB drives, backup media, and other electronic devices can also contain sensitive information.
That means a school’s records-management and destruction program needs to account for more than paper.
The Virginia regulations specifically address electronic records containing Social Security numbers, including requirements for overwriting data and making information unrecoverable.
So when a school replaces a computer, retires a hard drive, or cleans out an old storage area, the question shouldn’t simply be:
“Did we delete the files?”
It should be:
“Can the information still be recovered?”
Secure Destruction Is the Final Step
Secure destruction is the final step in the information lifecycle. For schools, that means first determining what records can be destroyed and when, following the applicable retention schedule and disposition requirements, and then using an appropriate method to permanently destroy information once it is eligible for destruction.
For paper records designated for confidential destruction, that may mean secure document shredding. For electronic records and retired equipment, it may require an appropriate method of hard drive destruction or physical destruction of the storage media.
For schools and school divisions that use an outside destruction provider, the process should provide accountability from the moment records leave the school until their final destruction. Secure containers, controlled transportation, documented chain of custody, and Certificates of Destruction can help schools maintain that accountability.
Rover provides secure data destruction for schools, school districts, colleges, and universities, helping educational institutions securely destroy sensitive paper records and electronic media with secure collection, documented chain of custody, and Certificates of Destruction.
Request a Free Quote
Need secure document shredding, hard drive destruction, records management, or IT asset disposal services?
Boxes of records piling up? Old hard drives collecting dust? Let’s take care of that.
Or, complete our short form and we’ll respond within 24 hours.
