Part 5. Administration

5.9 Accountability

Version 1.0 ·Updated 2026-10-07

Next reviewed by 2027-04-07.

Written for a school's staff learning how Kestrel works, the trainers who teach them, and the families using the portal.

What the school can show when it is asked to account for something: who is signed in, how long each record is kept, the register of privacy requests and the audit trail.

Written forITPrincipal and executiveBusiness manager

What this group is for

The group "Accountability" contains what the school can show when somebody asks it to account for something. It lists who is signed in now, how long each kind of record is kept, the privacy requests the school has received and an audit trail of what each person did. The screens are for reading and for recording requests. Nothing here changes how long a record is kept or edits the trail.

Who uses it

The privacy officer alone can read the privacy register. The principal and the IT administrator can read the audit trail, and the principal alone can download the school export. Each of these screens needs its own capability, so a role that has none of them does not see the screen.

Key ideas

Retention class: A group of records that are kept for the same period.
Privacy request: A request about information the school keeps, such as for a copy, a correction or deletion.
Audit trail: The record of who did what and when. Each entry is linked to the one before, so a change or a gap shows.
Legal hold: A reason a record is kept past its period. While one applies, disposal does not run.

Screens

Signed in now
/app/settings/signed-in
Each signed-in staff member, how long they have been in and when they were last active.
Retention
/app/settings/retention
How long each class of record is kept.
Privacy requests
/app/settings/privacy-requests
The register of requests and recording a new one.
Needs tenant.privacy.read
Audit trail
/app/settings/audit
The trail of what each person did, with a verdict on whether it is intact.
Needs tenant.audit.read
School export
/app/settings/export
A complete copy of the school's records in one archive.
Needs tenant.data.export

Who is signed in

"Signed in now" lists each signed-in staff member with "Signed in for", "Last active" and the Page they are on. It is at most a minute behind. There is nothing to set.

How long records are kept

"Retention" is read-only. Its columns are Class, "What the period rests on" and "Kept for". Disposal runs each night at 2:30 in the school's time zone, unless a legal hold applies.

Class	Kept for
Child safety	45 years, from date of birth
Attendance register	7 years
Academic record	25 years
NCCD evidence	7 years
Immunisation	3 years
Health record	25 years
Audit trail	7 years
Enquiry only	2 years
Operational	7 years

Privacy requests

"The register" lists each request by Reference, "Asked for", About, Arrived and "Due by". Choose "Record a request" when one arrives. The kinds are "A copy of the record", "A correction", "Deletion", "A question", "A complaint", "How a child's information is handled" and "Destruction of a child's information".

Choose "Record a request".
Say "What was asked for", "Who asked" and "How it arrived".
Enter "The day it arrived" and "Whose record it concerns".
Save. The register gives it a reference and works out when it is due.

If an answer needs longer, choose "Extend to sixty days", which opens "Record the extension". Give the day the notice went out and why the answer needs longer. Where the school refuses to destroy a child's information, the ground in section 32(3) is recorded.

The audit trail

A line at the top says whether the trail is intact. If it is not, an entry has been changed, is gone or is out of order. The line tells you to take a copy and tell whoever runs Kestrel.

Filter with "What to show", Who and "Which record". The columns are Who, "What they did", When and Entry, and "Show earlier entries" pages back. Open an entry to read "Reason given", "Records named" and "Position in the chain". Nothing in the trail can be edited.

Choose "Take a copy".
Say "Why this copy is needed". For a subject access request, name it and who asked.
Download the copy as CSV.

The copy itself is recorded in the trail under your name.

The school export

"School export" downloads a complete copy of the school's records as one ZIP archive, at no cost and as often as the school needs one. Each table is in it twice, as CSV and as JSON, beside the published data model, a manifest and each document the virus scanner has passed.

Choose "Download the archive".
Confirm with your passkey when Kestrel asks for it.
Keep the archive somewhere only those who may read the whole record can open it.

When the school's agreement ends, it has 60 days to take a copy. Thirty days after that, Kestrel destroys the school's records.

Tasks

Record a privacy request. Record and answer a privacy request
Read the audit trail. Read the audit trail
Check how long a class of record is kept.

Journeys that use this chapter

Settings

This group has no choices to make. The periods on the retention screen are fixed, the trail cannot be altered and the signed-in list has nothing to set. The privacy register is the one screen where staff add something, a request.

Training notes

Show the verdict line on the audit trail so staff know what an alarm looks like.
Practise recording a request with a made-up reference.
Explain that retention follows the class of record, not the person who asks.