How long should we keep a student's documents?

Financial and tax records have their own statutory retention period, which your accountant can state exactly. Copies of personal documents such as passports and bank statements should be kept only while there is a reason to hold them, and that reason usually ends when the student departs.

Is it legal to keep a copy of a student's passport?

While you are handling their application, yes, with their knowledge and for that purpose. Keeping it indefinitely afterwards is harder to justify and increases what you lose in a breach.

What about WhatsApp and Viber conversations?

They are records, and they are sitting on personal phones outside your control. When a counsellor leaves, that history leaves too. Anything that matters should be summarised into the student's file at the time.

Do we need written consent?

Tell students plainly what you collect, why, who sees it and how long you keep it, and get their agreement in writing. It is good practice regardless of what any particular rule requires, and it is the document that protects you in a dispute.

Who in the office should see a bank statement?

The people working that file, and nobody else. A receptionist entering an enquiry has no reason to open a family's finances, and an office where everyone can see everything cannot say who saw what.

Compliance

The student records you are obliged to keep, and the ones you should delete

The OfficeYak team, Written for consultancy ownersLast checked 26 September 20266 min

OfficeYak guide to student record keeping and data protection for consultancies

A consultancy holds more sensitive material about a family than their bank does. Passports, citizenship certificates, academic records, bank statements, property valuations, sometimes medical documents. For hundreds of families at once, often on a shared drive with a password three people know.

Most owners have never thought about this as a risk, because nothing has gone wrong yet.

What you have to keep

Two categories, and they are different.

Financial and tax records have a statutory retention period. Invoices, receipts, commission statements, payroll. Your accountant can tell you exactly how long, and the answer is measured in years. Keep them properly; this is not discretionary.

The student's own application record is worth keeping for your own protection: what was advised, what was submitted, what was agreed about fees. If a family disputes something two years later, this file is your account of events. Keep the record of the work.

That is not the same as keeping the documents themselves.

What you should be deleting

Copies of personal documents once their purpose has ended.

There is no reason for a consultancy to hold a scanned passport, a citizenship certificate and three months of a father's bank statements for a student who departed two years ago. The application succeeded. The purpose is complete. All that remains is risk.

Set a retention period for the sensitive material specifically. When a student departs, keep the record of what you did and destroy the copies of their identity and financial documents. It is a ten minute decision and it removes most of what a breach would expose.

Who can open what

The common arrangement is a shared folder everyone can see. It is easy and it means you can never answer the question that matters after an incident, which is who opened that file.

A workable minimum:

Documents visible only to the people working that student's file
Financial material such as bank statements and salary documents restricted more tightly again
Access recorded, so opening a file leaves a trace
Staff payroll never visible to counsellors, which owners often overlook until it causes a problem

None of this implies distrust. It means that when something goes wrong, you can say what happened rather than guessing.

The WhatsApp problem

Most of the real conversation with a student happens on a personal phone. The fee that was agreed, the promise that was made, the document that was sent at eleven at night.

Two consequences. You have no record, so a dispute is one person's memory against another's. And when that counsellor leaves, the history leaves in their pocket, including a hundred families' documents.

The fix is not banning it, which fails. It is that anything consequential gets written into the student's file at the time: what was agreed, what was sent, what happens next. Two lines. Whoever is in the office tomorrow can then pick the student up.

Tell students plainly

One page, given at the first meeting: what you collect, why, who inside the office sees it, how long you keep it, and how they can ask for it to be deleted.

This is good practice regardless of which rule you are reading, and in a dispute it is the document that shows you behaved properly. It also distinguishes you. Very few consultancies in Nepal hand a family anything like it, and families notice who treats their papers seriously.

What to do this month

Three things, in order.

Find out where the documents actually are. Usually more places than the owner thinks: a shared drive, two laptops, a WhatsApp backup, a filing cabinet.

Pick a retention period and apply it once, retrospectively. Departed students from more than a year ago: destroy the sensitive copies, keep the record of the work.

Decide who can see financial documents, and make that real rather than a rule people remember.

None of this wins you a student. It is the difference between an incident being an inconvenience and being the end of your reputation in a city where families talk.

Common questions

How long should we keep a student's documents?: Financial and tax records have their own statutory retention period, which your accountant can state exactly. Copies of personal documents such as passports and bank statements should be kept only while there is a reason to hold them, and that reason usually ends when the student departs.
Is it legal to keep a copy of a student's passport?: While you are handling their application, yes, with their knowledge and for that purpose. Keeping it indefinitely afterwards is harder to justify and increases what you lose in a breach.
What about WhatsApp and Viber conversations?: They are records, and they are sitting on personal phones outside your control. When a counsellor leaves, that history leaves too. Anything that matters should be summarised into the student's file at the time.
Do we need written consent?: Tell students plainly what you collect, why, who sees it and how long you keep it, and get their agreement in writing. It is good practice regardless of what any particular rule requires, and it is the document that protects you in a dispute.
Who in the office should see a bank statement?: The people working that file, and nobody else. A receptionist entering an enquiry has no reason to open a family's finances, and an office where everyone can see everything cannot say who saw what.