How long should schools keep certificate records?

Two kinds of record, two clocks

A school keeps two different kinds of record about every certificate it grants:

• The record of the award: who received which certificate, for what, on which date, with which result, and whether it was later corrected or withdrawn. This is what a verification request asks about, and graduates rely on it for the rest of their working lives.
• The supporting material: applications, attendance sheets, exam scripts, correspondence. It explains how the award was decided, and is usually needed only for a limited time, for appeals and audits.

Retention schedules treat them differently, and so should you.

What registrars recommend: keep the academic record permanently

In the United States, the American Association of Collegiate Registrars and Admissions Officers (AACRAO) publishes a guide to the retention and disposal of student records. Institutional schedules based on it, such as those published by D'Youville University and Duke University, list the academic record and the transcript as records to keep permanently, together with graduation lists and original grade sheets. The same schedules set shorter periods for much of the supporting material.

What US law says: FERPA

The Family Educational Rights and Privacy Act (FERPA) does not set a general retention period for education records. It does set two limits. An institution may not destroy education records while a request to inspect and review them is outstanding (34 CFR 99.10(e)), and the record of disclosures it must keep for each student has to be kept as long as the education records themselves (34 CFR 99.32).

What the GDPR says: no longer than necessary

In the European Union and the European Economic Area, the General Data Protection Regulation requires personal data to be kept in a form that identifies people for no longer than is necessary for the purposes for which it is processed: the principle of storage limitation, in Article 5(1)(e). Longer storage is allowed for archiving in the public interest, scientific or historical research, or statistics, subject to the safeguards of Article 89(1).

For a school, that means stating the purpose of each record. Being able to confirm, for as long as a graduate may need it, that a certificate was granted is a clear purpose for the record of the award. It is a much weaker reason to keep every exam script. Ask your data protection officer to confirm the periods for your institution.

Spain: a national register of official degrees

In Spain, Real Decreto 1002/2010 created the Registro Nacional de Titulados Universitarios Oficiales, a public register of official university degrees kept by the ministry responsible for universities. Graduates can consult it and authorise others to check their degrees. The register covers official degrees only, so an institution's own qualifications and short courses remain its responsibility to record and confirm.

A practical retention schedule

The periods below are a starting point to adapt with your own legal advice, not a rule:

What changes when certificates are digital

A digital certificate does not remove the need for a register; it makes the register the source of truth. If the verification page is the proof, the page has to keep answering for as long as the certificate matters, which means the provider's retention policy becomes part of yours. Ask any provider what happens to verification if you stop being a customer.

In Emitcert, each certificate is a fixed record: its words are copied in when it is granted and signed, and withdrawal is the only later change, recorded with its date and reason. Every action is written to an audit trail that cannot be edited. When an organisation closes its account, the certificates it granted keep verifying. For how the rest of the process fits together, see how to issue verifiable digital certificates.